Hey everyone welcome to extracting and analyzing browser email and I am artifacts in the previous video
we learned how to use Regg repr to retrieve and analyze data from the Windows registry.
Nowadays desktop PCs and laptops are almost always connected to the Internet and most of their usage
is related to any sort of online activities.
So it's easy to understand that the extraction and analysis of Internet artifacts plays a primary role
in digital forensics.
In this video we're going to take a look at how to take advantage of the tools installed on Kalli Linux
to extract and analyze artifacts related to the most common internet activities web browsing email and
instant messaging.
We're going to examine artifacts from the most common browsers like Internet Explorer Firefox and Chrome.
Next we're going to show how to retrieve e-mail messages for common client programs like Outlook and
Thunderbird.
Finally we're going to see how to extract artifacts from a popular I am quiet.
Skype a myriad of data can be extracted from browsers most relevant for forensic investigation.
Our catch history bookmarks cookies and downloaded files.
We start taking a look at Internet Explorer or IEEE that is pre-installed by default on Windows and
perhaps is still the most widespread browser.
IEEE stores its data both and registry keys and in Biles under the user's profile directory typed you
or else for auto completes and preferences are stored and registry keys under key underscore current
underscore user slash software slash Microsoft slash Internet Explorer favorites are located in the
same folder across all versions of Windows user profile favorites.
They're saved just plain text files so they can be inspected directly prior to IEEE vs 10 browser history.
Catch and cookies are stored in index godat files under the user's profile directory.
Here they are locations of the history catch and cookies artifacts.
Now we're going to introduce to Seelye tools that come pre-installed with Kallie Linux to analyze indexed
Ahdaf files and cookies respectively Pascoe and GALERA.
The usage of Pascoe could not be easier as it only takes one input parameter.
The indexed Ahdaf bile and has no other options.
We run it on an indexed Ahdaf file to show a practical example.
The output shows data from a history file such as the visited you or else the access time file and so
on.
Now we take a look at Galera which is a Spanish word meaning cookie.
So we moved to the directory where the cookies are stored
list the contents of the directory
and run the tool against for example this cookie
usage of Galera is very similar to that of Pascoe as it takes a cookie txt file as input.
The output is far more readable than look directly into the cookie text file and it shows information
such as the site name of the variable and its value and the creation and expiration times from Bersa
10 and above.
IEEE stores data related to the browser history and extensible storage engine or EMC database file in
particular web catch via one def file.
These kind of files are not accessible using Pascoe to read and extract A.S.C. database as a package
called lib SCDP containing libraries and tools has been developed.
This package is not pre-installed with Cali Linux so we would have to install it through the usual command.
Apt get install
the output shows that the package is already installed.
We execute the utility ECD be export on the sample web catch via 1. dat file
as you could see in the directory listing a folder with the same name of the input file and the suffix
export has been created.
If we list the lib ESG directory we could see a bunch of text files has been generated.
These files could be created manually.
Unfortunately at the moment no open source tools seem to be available on Linux to automatically extract
and present the data in a more readable and time ordered manner.
Some free tools have been developed for Windows by inner soft and Mandaean so they can be run on Linux
use in the wine program.
As we've seen with Reg Ripper in the last video now that we've covered IEEE we cover other two very
common browsers Firefox and Chrome.
They both store most of their data in sequel database files.
The files are as follows.
History and bookmarks places not sequel lite cookies cookies not sequel lite downloaded files downloads
not sequel light form auto completes form history dot sequel lite.
Firefox also stores its data in one location app data.
Google Chrome on Windows XP and older and an app data local Google Chrome on Windows Vista and newer
on Linux.
The path is home name.
Mozilla Firefox Chrome also stores its data in one location app data.
Google Chrome on Windows XP an older app data local Google Chrome on Windows Vista and newer on Linux.
The paths home user name config.
Google Chrome the name of the piles of interest are SELP explicative for example cookies for cookies
and history for history to read and extract data from a sequel database file.
We could use the sequel IDB browser that is installed by default on Kelly Linux.
Data is stored in various tables within the databases so sequel queries must be executed.
To extrapolate the data of interest we're only going to see how to extract browser activity data from
sample Firefox and Chrome history file.
First we open with sequel IDB browser.
The place is not sequel lite database that contains the Firefox history data.
Notice the database is composed of 11 tables two tables store the basic browsing history data.
Most history visits and most places that are linked between the ID field in most places in most history
visits
to display the browser history.
We can execute an opposite sequel query that I saved or convenience in a text file as the query is quite
long to digit it manually.
We could select and copy the query paste it into the execute sequel window and execute it.
We could see in the output the visited you Your else ordered by the visit date and time for crome.
The procedure is very similar.
We open the history file and see there are nine tables of which you are else and visits store the browser
activity data
to display the data we execute a query similar to that of Firefox
copy the query and paste it in the execute sequel window.
To extract other types of data such as cookies and bookmarks we can execute similar queries on the relative
databases and tables.
So far we've seen how to extract artifacts from the most common browser.
Now it's time to see how to extract and analyze e-mails from two of the most common email clients outlook
and Thunderbird.
These clients are mostly used within corporate environments.
While Web based e-mail services are far more used by private users we don't cover web email because
in this case e-mails are stored on the mail server not on the local system.
Outlook stores emails impersonal storage table or PSP files that could store emails from M-S exchange
service.
Also from P3 IMAP even HTP emails can also be stored in offline storage table or OS t format a Microsoft
Exchange based environments the locations where the user's PC files are located.
For Windows XP and older are as follows.
Windows XP and older app data Microsoft Outlook for Windows Vista newer app data roaming Microsoft Outlook
Thunderbird instead uses the mbox format that is a plain text format mainly used on cross-platform clients.
It stores its data in the following locations.
Windows XP an older app data Thunderbird Vista a newer app data roaming Thunderbird for Linux home user
named Thunderbird.
P.S. TIF files cannot be analyzed directly but we have to use specific tools one of the tools pre-installed
on Kelly Linux is called Read p.s..
This converts P.S. TIF files into the mbox format.
We open a message to analyze its headers that are the metadata associated with the message.
The headers are numerous and are added by the sender's client by the A.P. servers that process the message.
We might have to establish if an e-mail has really been sent from the claimed address or if it's a spoofed
phishing email.
The Received headers show the routing information in reverse chronological order with the host names
and IP addresses of the same T.P. servers that process the email.
We could see the center's mail server that should be on the same domain to that of the sender's email
address.
If it's from a different domain it's likely to be spoofed.
In some cases the senator's IP address is also show.
So we could trace e-mail back to the source last topic of the video is the extraction of artifacts from
an I am program Skype which is one of the most popular in use Skype also keeps its data in sequel databases
located in the following directories.
Windows XP an older app data Skype Skype profile Windows Vista and newer app data roaming Skype Skype
profile for Linux home username Skype Skype profile.
Most of the data like chats messages calls contacts are kept in the main db file while the configuration
settings are stored in the config.
SML file.
We open the main db database with sequel IDB browser to view its structure
to view its structure and we can see all the tables relative to chat's messages calls contacts and so
on
to extract the data that interest us.
We could execute sequel queries like we've done with Firefox and Chrome.
Great job in this video we've examined artifacts from the most common browsers like internet explorer
like i.e. Firefox Chrome.
We also showed how to retrieve email messages from Commack client programs like Outlook and Thunderbird
and we saw how to extract artifacts from a popular I am client Skype.
In the next video file analysis tools we're going to cover the analysis of different kinds of files
using the CLID tools installed on Kalli Linux.