Firefox Forensics

This week I talk Firefox forensics and identify the artifacts examiners need to know about.

Show Notes

Below are the artifacts I talk about in the Podcast along with their respective file paths and freely available tools you can use to parse the data.

Firefox Bookmarks, Downloads, History

C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\profile\places.sqlite

Tools:

http://www.nirsoft.net/utils/firefox_downloads_view.html

Firefox Cookies

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profile\cookies.sqlite

Tools:

http://sqlitebrowser.org

http://www.nirsoft.net/utils/mzcv.html

Firefox Cache

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\profile\cache2

Tools: http://www.nirsoft.net/utils/mozilla_cache_viewer.html

Firefox Preferences

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profile\prefs.js

Tools: http://sqlitebrowser.org

Firefox Profiles

C:\Users\\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tools: Text editor

Firefox Passwords 

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profle\key3.db 

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profle\logins.json

Tool: PasswordFox: http://www.nirsoft.net/utils/passwordfox.html

Firefox Sessions

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profle\Sessionstore.js

Firefox Addons

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\profile\addons.json

SDF Training Class of the Week

Learn More

Resolving Attached USBs

Learn to connect the dots and reconstruct attached USB devices on Windows system.
Learn More

DFSP Sponsors make the Podcast possible. Show them your love and support!

Makers of Insight Forensic  an all-in-one forensic data recovery and acquisition system

The developer of RECON – the fastest and most complete way to process Live running Macs or Mac forensic images

Check out all the classes in the SDF series – quality content at a solid training value