Tuesday, March 11, 2008

Export IE Internet History from unallocated for use with 3rd party processors

A user recently contacted me about an old v4 EnScript that was used to export Internet Explorer Internet history from Unallocated so it could be processed with NetAnalysis. She asked if I would update the EnScript to work with v6 since she explained that she used NetAnalysis with almost every case and they have become accustomed to the output.

I have updated the EnScript to work with V6. Simply select (blue check) and file(s) you wish to search for IE Internet History (Unallocated, pagfile.sys, hiberfil.sys, etc.) and then run. If any history is found, it will be exported to a file that can then be parsed by NetAnalysis (or other 3rd party tool).

Download Here


DC1743 Sunday, 27 April, 2008  


Notwithstanding the use of this enscript for other third party tools, NetAnalysis itself has a component called Histex which is designed to parse internet history from unallocated, page file etc.

Regards Richard

tk_lane Saturday, 12 July, 2008  

I don't know if I am the only one to try and use this but the EnPack has a license protection on it for GSITraining. Could you post a license free version. Also I am currently working a case where net analysis history extractor has missed a substantial part of the history in unallocated space or page files. Just a note to the previous comment.

DC1743 Monday, 14 July, 2008  

Please may I ask how the history extractor was run? Was it against a live write blocked physical disk or was Encase PDE or VFS or another method used?

I use Histex routinely and have not encountered significant problems. I know that the developer - Craig Wilson - is very responsive in fixing issues.

tk_lane Tuesday, 15 July, 2008  

I was using HistExtractor on pagefile and unallocated space with VFS. It would run but missed results very important to the case. I knew about the history entries because they resided with in UA as keyword search hits that were not being populated in Netanalysis after extraction

DC1743 Tuesday, 15 July, 2008  

Hi Again,

Encase VFS has (I believe the issue is still unresolved) a bug which causes it to present only the first 4gb of any file greater than 4gb. Therefore for example if your "unallocated clusters" file is 16 gb VFS will repeat the first 4 gb of the file four times.

So if you run histex against the "unallocated clusters" file or a pagefile larger than 4gb served by VFS it will not have the opportunity to parse all the data thus seeming to miss stuff. I use histex against an entire PDE mounted disk or a beta version that runs accross the e.01 evidence files (without having to mount at all).


tk_lane Friday, 18 July, 2008  

That explains the problems with the Unallocated file presented in VFS but it does not explain the pagefile. The pagefile is only 1.5GB so it should not fail due to this bug. What I have done is write a replacement EnScript for this one and have used Net Analysis to import the data extracted by the EnScript which works well. I will post this EnScript to others on my blog when I complete my current engagement (Aug). Thanks for the comments on the problem.

Lance Mueller Monday, 21 July, 2008  

A new EnPack version has been posted. Not sure why you were getting a licensing problem, but I verified the newly built on has no license restrictions.

cheap computers Thursday, 06 August, 2009  

The comments are very interesting.

Unknown Monday, 02 June, 2014  

will this work with 7.09.05

Lance Mueller Monday, 02 June, 2014  

No, this was designed for EnCase v6.

Post a Comment

Computer Forensics, Malware Analysis & Digital Investigations

Random Articles