Page 1 of 1

session restore JSON bread trail

Posted: Tue Jul 08, 2014 11:26 pm
by morganism
was doing an undelete/recovery on some files, and tripped across this on accident.

http://www.woanware.co.uk/forensics/fir ... actor.html

http://sessionmanager.mozdev.org/histor ... on=0.8.1.3


and even scrambled SQLdatabases can be recovered
http://www.cgsecurity.org/wiki/PhotoRec

more scary stuff here
https://forensiccontrol.com/resources/f ... et-history


edit,
and this looks like a good registry exporter for windows folks. might also be good for finding and removing un-used network protocols, and looking for BadBios headers http://www.securityartwork.es/2013/10/3 ... 2/?lang=en

http://www.mitec.cz/wrr.html

Re: session restore JSON bread trail

Posted: Wed Jul 09, 2014 12:42 am
by therube
( your links broke,
need to, generally, enclose them [url] tags,
actually, on this board, any time you edit
a URL & it is past a certain length, it breaks,
don't ask me why? so if you were to edit
your post, you'll end up breaking your
unbroken links ;-) )

http://www.woanware.co.uk/forensics/fir ... actor.html

So it parses .json files.
And like, the point? Just a text file anyway. You can parse it in any number of ways.

Re: session restore JSON bread trail

Posted: Sat Jul 12, 2014 11:02 pm
by morganism
It is just another complete web trail that it would be nice to clear on exit.

I'm paranoid about the sql databases with every download and website visit too...

Re: session restore JSON bread trail

Posted: Sun Jul 13, 2014 11:12 am
by therube