(Ebook) FOR500.5: Core Windows Forensics Part IV: Internet Browsers by Rob Lee, Chad Tilbury

(Ebook) FOR500.5: Core Windows Forensics Part IV: Internet Browsers by Rob Lee, Chad Tilbury

FOR500.5: Core Windows Forensics Part IV: Internet BrowsersOverviewWith the increasing use of the web and the shift toward web-based applications and cloud computing, browser forensic analysis is a critical skill. During this section, the investigator will comprehensively explore web browser evidence created during the use of Internet Explorer, Edge, Firefox, and Google Chrome. The hands-on skills taught here, such as SQLite and ESE database parsing, allow investigators to extend these methods to nearly any browser they encounter. The analyst will learn how to examine every significant artifact stored by the browser, including cookies, visit and download history, Internet cache files, browser extensions, and form data. We will show you how to find these records and identify the common mistakes investigators make when interpreting browser artifacts. You will also learn how to analyze some of the more obscure (and powerful) browser artifacts, such as session restore, tracking cookies, zoom levels, predictive site prefetching, and private browsing remnants. Finally, browser synchronization is explored, providing investigative artifacts derived from other devices.Throughout the section, investigators will use their skills in real hands-on cases, exploring evidence created by Chrome, Firefox, Edge, Internet Explorer, and Tor correlated with other Windows operating system artifacts.