Introduction

This version of NetAnalysis® introduces support for a number of new browsers as well as adding support for Chromium Simple Cache format used by a number of the mobile browsers. We have also added support for Microsoft Internet Explorer and Edge Recovery Store, Tab Session, Travel Log, Roaming Tab Sessions and the detection of InPrivate browsing.

New Browser Support

We have added support for the following browsers:

Opera Neon

Opera Neon is a new concept browser: “a vision of what browsers could become”. It was first released in January 2017 and is available for Mac and Windows.  The browser is Chromium based but with some additional unique features.  Opera Neon gives the user new ways to interact with web content, including the ability to drag, push and pop the tab icons.

NetAnalysis® will recover the standard Chromium based artefacts as well as the top sites, tab page icons and the gallery snapshots.  The tab page icons and the gallery snapshots are written to the case export folder and loaded into the Viewer window.

Brave

Brave is another new, open-source, multi-platform web browser developed by Brave Software; it is based on the Chromium web browser and its Blink engine. It claims to block website trackers and remove intrusive Internet advertisements. The browser also claims to improve online privacy by sharing less data with advertising customers.

NetAnalysis® will recover the standard Chromium based artefacts.

Updated Support for New Versions of Existing Browsers

All of the mainstream browsers have updated their file formats and added new features. In addition to adding new browser support, we have enhanced the support provided for existing browsers:

Google Chrome/Chromium Based Simple Cache for HTTP

This disk cache is used by default in Google Chrome on Mac OS X, Linux and Android mobile devices.  It can also be enabled on Chrome and most Chromium based browsers running on Windows desktop. It was initially designed as a simple cache back-end to deal with the IO bottlenecks which impaired mobile browsing performance on some platforms.

NetAnalysis® supports processing Google Chrome and Chromium based Simple disk cache and well as exporting and rebuilding web pages.

Firefox and Mozilla based permissions.sqlite

This database holds preferences about which sites are allowed or prohibited to set cookies, to display images, to open popup windows and to initiate extensions installation.

• http://kb.mozillazine.org/Cookies

NetAnalysis® can read this information and display the permission settings in the Information panel.

 

Vaivaldi Notes

Vivaldi browser allows the user to save notes while they browse.  A note can be linked to a specific web page and the user can attach full page or selected area screenshots as well as files from their computer.

• https://help.vivaldi.com/article/notes/

NetAnalysis® now recovers Vivaldi Notes.  The note content is written to the case export folder and indexed.  Any attachments are written to the case export folder.

Mozilla Firefox v2 Cache

The Disk Cache format v2 for Mozilla Firefox has evolved and changed. NetAnalysis® supports all versions of this disk cache format and allows cache objects to be exported as well as rebuilding web pages.

Microsoft Recovery Store, Tab Sessions, Roaming Tab Sessions and Travel Logs

Microsoft Internet Explorer and Edge browsers keep track of browsing history in two main ways; History and Travel Log. The active tab’s list of back/forward navigations is called the Travel Log. Within Internet Explorer, you can see this list with a click-and-hold on the back or forward arrow. This data can also be used for recovering sessions in the event of the browser crashing, or by starting a new session with tabs from the last session when set as an option by the user. The browsers store this data in recovery store and tab session files.

 

Detection of InPrivate Browsing

If a user activates InPrivate browsing, the browser continues to write Travel Log data to the Recovery Store and Tab Session files. At the end of the InPrivate session, the browser deletes these files. NetAnalysis® has the ability to genuinely identify InPrivate browsing sessions and will flag them by placing an icon at the start of the URL (as shown below). HstEx® also has the ability to recover deleted InPrivate Recovery Store and Tab Session files.

Some forensic tools claim to recover InPrivate browsing, but in fact are only searching for URLs in the Travel Log stream and have no idea whether they relate to InPrivate browsing or not.

 

Improved Reporting

Reporting has been completely overhauled to allow reports to be generated on records filtered with a Find Panel active search as well as an active filter.  Previously, reports could be generated on all rows in the grid or on the rows visible when a filter is active.

There are some additional report templates.  A template based on the original NetAnalysis® v1 “Print – Current to PDF” report has been added named “Simple History”.  There is a new template based on the original v1 “Group By Host” named “History By Host” and a new template based on the original v1 “Group by Index Type” named “History By EntryType”.

Improved Cache Exporting and Page Rebuilding

The cache exporting engine has been revisited and considerably improved. We have increased processing speed, as well as enhancing the capability of the process. The following bullet points highlight some of the enhancements we have made.

• Cache extraction and page rebuilding has been improved to speed up processing and is able to handle much larger volumes of cached page data.
• Improved content detection.
• Added support for Brotli decompression.
• Google Chrome / Chromium Based cache v2 Sparse data entries are now extracted and used in cache export and page rebuilding.  Chrome uses this method to store large cache data in its disk cache.  Internally the cache stores the data as sparse chunks among a set of child cache entries that are linked together from a main parent entry.
• Processing “srcset” attribute has been added.
• Processing “data-thumb” attribute has been added.
• Processing “data-src” attribute has been added.
• Added support for Chrome Dictionary files during export.

Improved Exporting

Exporting functionality has been improved to include records filtered with a Find Panel active search as well as an active filter. Previously, the exported rows would be dependent upon the active filter or all rows in the grid would be included.

User Interface Improvements

We have made some changes to the user interface to enhance usability:

Save and Load Column Layout

It is now possible to save and reuse grid column layouts. We have provided a number of sample layouts to demonstrate the feature. This is particularly useful if you like to arrange the columns in a certain order, or if you like to remove some of the columns altogether. To save a column layout, select Column » Save Column Layout. To load a column layout select Column » Load Column Layout. There is also an option to save data grouping if you select save with Data Settings when saving the layout.

Right Click Grid Filter By

We have added two new dynamic filters which can be accessed by right clicking a target record. By selecting Filter By, a sub-menu will appear showing the Host Name and Browser Version strings for this record. Clicking either entry will result in a filter being applied relating to the clicked item.

 

Clear All Active Filters and Searches

Following user feedback, we have added a simple, one-click, option to remove all active filters and searches thereby restoring the full record count to the grid. This can be activated by selecting Tools » Show All Records (Shift + F5) or Right Click » Show All Records.

HstEx® v4.6

This release of HstEx® adds the ability to recover a number of new artefacts as well as adding support for two new browsers. We have also made a number of changes to support the modifications introduced by all of the main stream browsers.

New Features

HstEx® v4.6 now supports the following:

Microsoft Internet Explorer/Edge

Microsoft Internet Explorer and Edge browsers keep track of the visits for each tab; these visits are stored in what is known as a Travel Log. The Travel Log allows the user to navigate backwards and forwards through the log of visits. This information is saved into a Tab Session file. HstEx® can recovery individual Travel Log entries for Internet Explorer v8 to 11 and Microsoft Edge v20 to 38. HstEx® can also search for, and recover, Recovery Store, Tab Session and Roaming Tab Session data (including page thumbnails and previews).

Recovery of Data Relating to InPrivate Browsing

When Recovery Store, Tab Session and Roaming Tab Session files are targetted for recovery and the resulting data was from an InPrivate browsing session, NetAnalysis® has the ability to identify and flag such sessions.

Recovery of Google Chrome/Chromium Based Simple Cache for HTTP

This disk cache is used by default in Google Chrome on Mac OS X and Linux and also Android mobile devices.  It can also be enabled on Chrome and most Chromium based browsers running on Windows desktop. It was initially designed as a simple back-end to deal with the IO bottlenecks which impaired mobile browsing performance on some platforms. HstEx® can now recover Simple Cache entries.

New Browser Support

We have added support for the following browsers:

Opera Neon

Opera Neon is a new concept browser: “a vision of what browsers could become”. It was first released in January 2017 and is available for Mac and Windows.  The browser is Chromium based but with some additional unique features.  Opera Neon gives the user new ways to interact with web content, including the ability to drag, push and pop the tab icons.

HstEx® can recover the following:

• History Entries
• Download Entries
• Cookie Entries
• Cache Entries
• Simple Cache Entries
• Keyword Search Terms
• Form History
• Login Data

Brave

Brave is another new, open-source, multi-platform web browser developed by Brave Software; it is based on the Chromium web browser and its Blink engine. It claims to block website trackers and remove intrusive Internet advertisements. The browser also claims to improve online privacy by sharing less data with advertising customers.

HstEx® can recover the following:

• History Entries
• Download Entries
• Cookie Entries
• Cache Entries
• Simple Cache Entries
• Keyword Search Terms
• Form History
• Login Data

Introduction

This release brings support for Google Chrome’s History Provider Cache and Network Action Predictors, Microsoft’s Internet Explorer and Edge Typed URLs and Bookmarking across the various supported Browsers.

History Provider Cache

The History Provider Cache is a binary file which contains the data used by Google’s HistoryQuickProvider (HQP). The HQP serves up autocomplete candidates from the profile’s history database. As the user starts typing into the omnibox, the HQP performs a search in its index of significant historical visits for the term or terms which have been typed. The resulting candidates are scored and a limited number of only the most relevant matching URLs visited are presented to the user.

 

The image above shows the History Provider entries from a Google Chrome History Provider Cache file loaded into NetAnalysis. The History Provider Cache contains WordListItem and WordMapItem objects. These objects store the list of words used to search against. When the file is processed, they are written out to an external text file (located in the Export Folder) and are included in the list of files added to the search index.

Microsoft Internet Explorer and Edge Typed URLs

Microsoft Internet Explorer and Edge browsers also have a similar feature to Google Chrome’s History Quick Provider. As entries are typed into and/or selected from the Address Bar, the browser saves the entry to a location in the Registry under the sub-key TypedURLs. Over different Operating Systems and browsers, the number of entries stored has varied. In later releases, Microsoft has also added corresponding TypedURLsTime and TypedURLsVisitCount sub-keys. In NetAnalysis v2.4, we have added support for reading registry hive files and can extract the typed URL information. We can also read the corresponding time and visit count information. The information panel in the screen shot below shows the corresponding registry sub-keys for the data.

 

Network Action Predictor

We have added support for the import of Network Action Predictor data for Google Chrome and Chromium Based Browsers. This data can be either autocomplete predictor, resource prefetch predictor or logged in predictor entries.

If the autocomplete prediction feature is enabled, Chrome will use a prediction service to help complete searches and URLs typed into the omnibox. If the Chrome prerendering feature is enabled, the Browser will attempt to speed up navigation for a user by prerendering pages that it predicts the user is likely to navigate to.

The stored prediction data can be viewed live in the Browser by typing: chrome://predictors in the Chrome omnibox. Chrome will display tabs for both the Autocomplete Action Predictor and the Resource Prefetch Predictor entries. The Logged In Predictor entries were made obsolete as of Chrome v44.

The Autocomplete Action Predictor entries show a history of the characters the user typed into the omnibox and the URL that was then selected.

The Resource Prefetch Predictor entries list the resources that were predicted to be needed for a given URL. The Browser determines which resources to fetch based on prior browsing history.

In the screen capture above, the user text entered by the user is shown in the information panel against the associated Autocomplete Predictor entry.

Bookmarks

We have added support for the import of bookmark data as well as extraction of associated Bookmark images to the export folder for the following browsers:

• Mozilla Firefox and Mozilla Based Browsers
• Google Chrome and Chromium Based Browsers
• Apple Safari (including Reading List)
• Opera Presto v3-12
• Opera Presto v7-12 Notes
• Opera v15-16
• Opera v25+
• Netscape HTML Bookmarks

Apple Safari bookmarks are stored in the Bookmarks.plist file. On Mac OS X, Safari also stores the user Reading List entries in this file whereas under Windows, these were stored in a separate ReadingList.plist file. When Reading List entries are extracted, any preview text is copied to the export folder. We support importing data from both Bookmarks.plist and ReadingList.plist files.

Opera Presto stored its bookmarks in a Hotlist format file. This format was also used to store Opera notes. NetAnalysis can now extract bookmarks for Opera v3-12 and notes for Opera v7-12.

Opera v15-16 stored its bookmarks in a bookmarks.db database. Opera v17+ then reverted to using the Chromium based file format. Opera added their own extra structure on top of the Chromium format from Opera v25+. NetAnalysis now supports all of these format variations. Any bookmark web page preview image files are also extracted to the export folder. These previews can be displayed using the Viewer panel.

The Netscape HTML file format is still widely used as a data exchange format by the current Browsers. The latest versions of Chrome, Firefox and Safari allow the user to import and export bookmarks in this format; while Opera allows the user to import Netscape HTML format bookmarks. Any Netscape HTML file format bookmark favicons are therefore copied to the export folder under folder name “Unidentified Browser”.

The screen capture above shows bookmark and reading list data from Apple Safari v9. The screen capture below shows bookmark data from Opera v36.

Change Log

• NetAnalysis v2.4 Change Log
• HstEx v4.4 Change Log

 

We are pleased to announce the next major release for NetAnalysis® and HstEx® has just been published. For an overview of the new features we are shipping inside NetAnalysis® v2.1 and HstEx® v4.1, please take a moment to review our release notes:

• NetAnalysis® v2.1 Release Notes
• HstEx® v4.1 Release Notes

Here is an example of some the updates:

Username and Password Decryption

Firefox and other Mozilla based browsers include a Password Manager that can save the passwords provided by the user as they log in to websites. The Password Manager securely stores the usernames and passwords used to access websites and then automatically fills them in for the user when they next visit the site. For additional security, the user can also set a Master Password to protect the Password Manager. The user is then prompted to enter the Master Password when the browser needs to access the stored passwords. Usernames and passwords are encrypted and stored within the Mozilla profile.

NetAnalysis® v2.1 is now able to decrypt and display the usernames and passwords stored for each web site. The following image shows the NetAnalysis® Information Panel with some decrypted Username and Password values. Also, the entry on line number 1 shows that the Master Password has not been set in this case.

 

 

New Browser Support

In addition to extending support for the existing browsers and their recent changes, we have now added support for two new browsers:

• SRWare Iron v1 – 38
• K-Meleon v1 – 74

Apple Safari 8

Apple Safari v8 was released with OS X Yosemite and brought with it a change to its history storage. As a result, HstEx® v4.1 has been updated to support the recovery of individual entries from Safari v8 history records. History records are split across History Items and Visits. We offer an option to recover both types.

 

 

Improvements

We have been working hard to increase the performance, accuracy and stability of HstEx® v4. As a result, we have updated all of our SQLite recovery engines to ensure they are accurate and fast. We have improved the handling and reporting of corrupt entries (partially recovered records are flagged in NetAnalysis® v2). We have also made some improvements to the recovery of Binary Plist data.

Firefox v32+ Cache v2

Mozilla Firefox officially released their new caching backend with the release of Firefox v32 back in September 2014. The structure is completely different from that used previously. HstEx® v4.0 was the first forensic tool to support the recovery of deleted Mozilla Firefox Cache v2 records. After Firefox v33 was released, Mozilla made some further changes to the file format. HstEx® v4 supports all the currently released formats of Mozilla’s Cache v2 structure. We have also made some further improvements to the recovery of Cache v2 records, in particular the identification of corrupt data.

Keyword Search Terms

We have extended support for the recovery of individual keyword search terms for all Chromium based browsers and have improved the recovery of very large keyword strings.

New Artefacts

We have added support for the extraction of over a dozen new artefacts and data types. For a detailed list of each artefact, please see the following:

• New Artefacts in NetAnalysis® v2.1

Here are a few examples:

Google Search EI/SEI Parameter Decoding

Google search URLs will sometimes contain an EI or SEI parameter. We have added support to the URL/Cookie Examination and Analysis window to allow automatic decoding of these parameters. The window below shows the automatic decoding of a Google URL which contains an EI parameter. The EI parameter is a Base64 encoded 16 byte value. The first 4 bytes contain a timestamp which can be seen in the example below.

 

 

Google Chrome Autofill Profiles

Autofill forms is a feature of Google Chrome and other Chromium based browsers. It allows for the user to store information such as name, address, phone number and email address as an Autofill entry so that forms can be automatically populated. In NetAnalysis® v2.1, we extract the data from the Autofill Profiles and display them in the main grid. We also extract the corresponding form data and save it to the export folder for indexing and searching.

 

Google Chrome Credit Card Autofill

The window below shows the extraction of Google Chrome Credit Card Autofill data. The text relating to the autofill fields are extracted to the export folder so that the data can be indexed and searched.

 

Apple Safari Reading Lists

The window below shows a number of Apple Safari Reading List entries. These represent sites the user has selected to view at a later date. Once the user visits a site from the Reading List, the Date Visited is updated to reflect the date and time of the visit.

 

 

Opera Blink Favorite Entries

The window below shows a number of Opera Favorite entries.