Download Lab 7

•
•
Safari (Apple OS X)
Opera
What this means is that the investigator no longer has to memorize the paths for Internet
activity files for each web browser. Web Historian also has the ability to output the
reconstructed data into the following formats:
•
•
•
Native Excel Spreadsheet
HTML
Delimited Text File
A screenshot of Web Historian in use is shown below in Figure 2.
Figure 2. Web Historian in action.
Analysis of the web history
Now that we have the output for Joe's IE Internet activity, we can begin reviewing the
websites he visited. During this analysis, we will only present the activity that is relevant to
the investigation since there are numerous instances of irrelevant web browsing events that
can slow down an investigator. The output from Web Historian is shown below in Figure 3.
Figure 3. Web Historian output.
In the above output we see that Joe visited Hotmail.com. Web Historian shows that the visit to
Hotmail created the file named 8R9KCL4N\HoTMaiL[1].htm in the cache directory. If we
open this cached file, we will see the following web page in Figure 4.
59