Dr. John Abraham
Linux and MAC
Linux and Mac artifacts are given in chapters 6
Students are encouraged to read these
Bulk of the user interaction now is through the
Application specific artifacts created by web
browsers provide important evidence
he index.dat file is a database file.
It is a repository of information such as web
URLs, search queries and
recently opened files.
Its purpose is to enable quick access to data used by Internet Explorer.
For example, every web address visited is stored in the index.dat file,
allowing Internet Explorer to quickly find Autocomplete matches as the
user types a web address.
The index.dat file is user
specific and is open as long a user is logged on in
Separate index.dat files exist for the Internet Explorer history, cache, and
The index.dat file is never resized or deleted. A large index.dat file can
Pasco (download) can be used to view.
Malware can make use of
API to infect computers. Entries are
made in index.dat files for the default user or
A user’s favorites can provide info regarding a
users movement across the Internet.
Cookies are saved as plain text files
Galleta (download) can display formatted.
The cookie will have creation time and
expiration time, site name and other useful
Cache is created as a result of a users
browsing activities. They are stored in
temporary internet files.
It will contain url location, times and file
Mozilla’s firefox is the second most widely
Stores history in the SQLite 3 database in
Files of interest: Formhistory.sqlite (contains
data filled out to submit forms and webmail
subject lines), downloads.sqlite, cookies.sqllite
and places.sqlite (users browsing activity).
Saved session data
if firefox is not
terminated properly, a file named
sessionstore.js is created. Used to recover
from a crash.
Bookmarks and backups
Other browsers are skipped
Personal storage table (PST)
Use Outlook to open or there are other tools
available such as
Mbox and maildir
Local mail storage formats used by Linux. Both
formats are plaintext. Mairix is a searching utility.