Forensic: Extracting the passwords registered in the browser

Friends, how are you? I came to you in the forensic analysis with something very important, which is extracting the passwords registered in the browser. As I talked before about the history file, we will talk about a file that is no less important than it, which is the Web Data file, which is located in this path:

C:\Users\-------\AppData\Local\Google\Chrome\User Data\Default 

Or you can of course use the everything tool and what it does in terms of a quick search. We will search, as we talked about it previously in the last lesson, about the file:

Now we take a copy of this file and put it away for dissection. We will open this file using sqlite-tool.

:After downloading and decompressing you will find 3 files

Paste the Web Data file with them.

replace the path of decomressed folder in windows explore with cmd then press Enter

Now we will call the file using the sqlite3.exe .

after press Enter:

 To know the tables in that file, we write the command: .tables or .ta

Now we will give some sql query:

Note: Please don't forget to put the semi-colon because of it the white hair appeared

after press Enter:

Written By : Ammar Yasser

Forensic: Dumpster Diving The Recycle Bin

Hello my friend who has acquired from yesterday or even new here in Ammar's Journey of Overcoming Worthlessness

How are you? Without much talk, let's talk about the heart of the matter. It is about the Recycle Bin. How full it is of mysterious things. Let's discover them together.

Locating Recycle Bin folder may make some people think that this folder is always only in C: and this is the happy case.

Download Everything program:

"Everything" is search engine that locates files and folders by filename instantly for Windows.

Unlike Windows search "Everything" initially displays every file and folder on your comput
(hence the name "Everything").

 search for recycle.bin, you may find it in all partitions.

if you try to access Recycle Bin folder you might get folder is empty , however , it's not empty it's contain hidden folders let's see.

replace path of recycle.bin folder in windows explore with cmd then press Enter

A pop up command line window will appear here we are:-
 

then type this command :- 

dir   /a

The result:-

We will try to access one of these folders using the cd command and then the folder name.

for example :-

  cd   S-1-5-21-228626994-3352609220-1901621244-1001

Note: There are other cases where access is denied. As a result, there is no problem. You just need a program like AccessData_FTK_Imager

Now we will try to see the contents of that hidden folder using the dir command.

• .You may have noticed that all files start with a $ sign and then the letter I or R
• I will tell you more. If you pay attention, you will notice that it begins with the letters $I, then $R
• Sometimes there are two files with the same name, the only difference is in the prefix $I, $R, for example.
• Finally you will notice a size next to the $R.

$I : contains the metadata about the file

This metadata includes (deletion timestamp, absolute path, file name, and file size)

$R: contains the actual file content.

If you try to access any $i file  that contains information using notepad you will get garbage because it is encrypted.

There was a tool called $I_Parse_v1.1. Unfortunately, its owner hid it from formal site, . I downloaded it two years ago so here is the link.

Very simple, just select the Mode, whether file or folder, from the top menu, enter the file path and get the decrypted file.

After we know the content of the tifo ($I0IYTQZ.ipynb), how do we get the tifo itself($R0IYTQZ.ipynb)? 

To get the real file, the simple and quick way is to copy the file to your desktop.

Bad but good because I will explain the alternative plan

Download AccessData_FTK_Imager from the official website and then come to the method

Written By : Ammar Yasser

Forensic: Analyzing the Web history files

Hello mates! How are you? It's my first post, and I'm very excited to start this series, which is titled "Forensic."

So, here’s a question to kick things off: Why is it important to access browsing history during digital forensic investigations?

For investigations related to digital forensic science, it's crucial for all users of different browsers to be able to retrieve their own browsing histories. This is especially useful in security audits and evidence gathering.

Every time you visit a website or make a search, your browser creates a history file that logs these actions. Each web browser has its own unique history file stored on your computer, but you can't open it directly. The contents are encrypted, meaning they look like gibberish unless you decrypt them. This encryption protects your information from unauthorized access.

However, there are tools, like ChromeHistoryView, that allow access to your browsing history for forensic purposes.

So, let's break the ice and dive into ChromeHistoryView, a tool that helps you access browsing history, even when it's encrypted.

  ChromeHistoryView is a small utility that reads the history data file of Google Chrome Web browser, and displays the list of all visited Web pages in the last days. For each visited Web page, the following information is displayed: URL, Title, Visit Date/Time, Number of visits, number of times that

the user typed this address (Typed Count), Referrer, and Visit ID.

You can select one or more history items, and them export them into html/xml/csv/text file, or copy the information to the clipboard and paste it into Excel.

You can also use this tool to read the history of other Chromium-based Web browsers, like Microsoft

 Edge, Opera, Vivaldi, and others... , 

it's doesn't require any installation process or additional DLL files. In order ti start using it, simply copy the executable file (ChromeHistoryView.exe) to any folder you like, and run it

Steps to Use ChromeHistoryView Tool:

1. Launch the program – Since it's portable, there's no need for installation, as mentioned earlier.
2. Go to Options in the menu.
3. Select Advanced Options.

4. Check the box for "Use the following history file or User Data folder."
5. Choose the browser history file you want to view.

6. You can customize the results by selecting options like:

• Load only the URLs visited in the last {number} of days.
• Load only the URLs visited in the specified date/time range.

Written By: Ammar Yasser