On the digital forensic analysis of the Firefox browser via recovery of SQLite artefacts from unallocated space

Research Output

A technique and supporting tool for the recovery of browsing activity (both currently stored and deleted) from the Firefox web-browser is presented. The approach is based upon applying file-carving techniques (matching regular expressions against raw disk images) to the problem of recovering recognizable fragments of internal database structures. The generality of the technique is discussed: It is potentially applicable not only to Firefox but also to any software that uses the popular SQLite embedded database engine such as the Apple Safari web-browser and many Android apps.

Conference programme -https://www.canterbury.ac.uk/social-and-applied-sciences/law-criminal-justice-and-computing/docs/cfet/cfet-2012.pdf

Type:

Conference Paper (unpublished)
Date:

06 September 2012
Publication Status:

Unpublished
Library of Congress:

QA75 Electronic computers. Computer science
Dewey Decimal Classification:

005.8 Data security
Funders:

Abertay University

http://researchrepository.napier.ac.uk/output/408478 <p>Bagley, R., Ferguson, R. I., & Leimich, P. (2012, September). <i>On the digital forensic analysis of the Firefox browser via recovery of SQLite artefacts from unallocated space</i>. Paper presented at CFET (Cyberforensics in Education and Training )</p>

Citation

Bagley, R., Ferguson, R. I., & Leimich, P. (2012, September). On the digital forensic analysis of the Firefox browser via recovery of SQLite artefacts from unallocated space. Paper presented at CFET (Cyberforensics in Education and Training )