Export IE Internet History from unallocated for use with 3rd party processors
A user recently contacted me about an old v4 EnScript that was used to export Internet Explorer Internet history from Unallocated so it could be processed with NetAnalysis. She asked if I would update the EnScript to work with v6 since she explained that she used NetAnalysis with almost every case and they have become accustomed to the output.
I have updated the EnScript to work with V6. Simply select (blue check) and file(s) you wish to search for IE Internet History (Unallocated, pagfile.sys, hiberfil.sys, etc.) and then run. If any history is found, it will be exported to a file that can then be parsed by NetAnalysis (or other 3rd party tool).
Download Here
ShareThis
Posts
10 comments:
Hi,
Notwithstanding the use of this enscript for other third party tools, NetAnalysis itself has a component called Histex which is designed to parse internet history from unallocated, page file etc.
Regards Richard
I don't know if I am the only one to try and use this but the EnPack has a license protection on it for GSITraining. Could you post a license free version. Also I am currently working a case where net analysis history extractor has missed a substantial part of the history in unallocated space or page files. Just a note to the previous comment.
Please may I ask how the history extractor was run? Was it against a live write blocked physical disk or was Encase PDE or VFS or another method used?
I use Histex routinely and have not encountered significant problems. I know that the developer - Craig Wilson - is very responsive in fixing issues.
I was using HistExtractor on pagefile and unallocated space with VFS. It would run but missed results very important to the case. I knew about the history entries because they resided with in UA as keyword search hits that were not being populated in Netanalysis after extraction
Hi Again,
Encase VFS has (I believe the issue is still unresolved) a bug which causes it to present only the first 4gb of any file greater than 4gb. Therefore for example if your "unallocated clusters" file is 16 gb VFS will repeat the first 4 gb of the file four times.
So if you run histex against the "unallocated clusters" file or a pagefile larger than 4gb served by VFS it will not have the opportunity to parse all the data thus seeming to miss stuff. I use histex against an entire PDE mounted disk or a beta version that runs accross the e.01 evidence files (without having to mount at all).
Regards
That explains the problems with the Unallocated file presented in VFS but it does not explain the pagefile. The pagefile is only 1.5GB so it should not fail due to this bug. What I have done is write a replacement EnScript for this one and have used Net Analysis to import the data extracted by the EnScript which works well. I will post this EnScript to others on my blog when I complete my current engagement (Aug). Thanks for the comments on the problem.
A new EnPack version has been posted. Not sure why you were getting a licensing problem, but I verified the newly built on has no license restrictions.
The comments are very interesting.
will this work with 7.09.05
No, this was designed for EnCase v6.
Post a Comment