session restore JSON bread trail

[morganism]

was doing an undelete/recovery on some files, and tripped across this on accident.

http://www.woanware.co.uk/forensics/fir ... actor.html

http://sessionmanager.mozdev.org/histor ... on=0.8.1.3


and even scrambled SQLdatabases can be recovered
http://www.cgsecurity.org/wiki/PhotoRec

more scary stuff here
https://forensiccontrol.com/resources/f ... et-history


edit,
and this looks like a good registry exporter for windows folks. might also be good for finding and removing un-used network protocols, and looking for BadBios headers http://www.securityartwork.es/2013/10/3 ... 2/?lang=en

http://www.mitec.cz/wrr.html

[therube]

( your links broke,
need to, generally, enclose them [url] tags,
actually, on this board, any time you edit
a URL & it is past a certain length, it breaks,
don't ask me why? so if you were to edit
your post, you'll end up breaking your
unbroken links )

http://www.woanware.co.uk/forensics/fir ... actor.html

So it parses .json files.
And like, the point? Just a text file anyway. You can parse it in any number of ways.

[morganism]

It is just another complete web trail that it would be nice to clear on exit.

I'm paranoid about the sql databases with every download and website visit too...

[therube]

http://kb.mozillazine.org/Session_Resto ... sion_store


Commandline JSON Pretty. Other methods mentioned in the comments.