Recovering Browser Cache

A couple of days ago my 12 year old daughter cleared the cache on our computer. The act alone has set alarm bells ringing.

Is there any way I can recover the cache? We are using Mozilla Firefox.

Thanks,

Miggsy

Try to look in /Documents and settings/<user>/Application data/yourFirefox/ Profiles/...

There it normally saves its cache i believe, maybe others can enlighten here, cause i don't
work in windows that often anymore.

Btw did she also deleted history files ? Also a firewall or alike do show in logs where you visited.
often it even shows url's. Hope this helps.

Cheers

Thanks Shrekkie.

I checked the cache file, that's how I realised it was her that did it because of the time of the earliest recorded activity. There is still history there but I'm fairly certain that she knows that if you right click practically anything you can delete individual items (including history items).

I didn't realise that there might be some traces on the firewall so I'll check that.

Thanks again.

Remember to check file size and number of days storage, as these things will automatically delete stuff anyway. As do a variety of clean up and maintenance programs.

Incidentally, it is good practice to clean the cache out regularly, both from a stability and a security viewpoint................a variety of problems can be resolved by emptying the cache.

Perhaps you should consider parental control software?

Cheers

or use a tool like undelete, and try to see what you can recover from your C disk, if you let it search for temp files too, it should at least be able to come up with all the cookies that were last on it (that is if it is not overwritten yet).

You can still get a good picture of where she's been by checking the cookies folder under her user profile. Take a good hard look at the temporary internet files too...

[edit] for the future, I suggest getting a watchdog program for your machine - logs everything, including keystrokes. This is how I keep tabs on my grandkids when they're down for a visit. I use McAffe's 'guard dog' but I know there's several others out there.
Hope that helps![/edit]

I will assume you are using Windows XP. Browse to your daughter's folder:

Get the tool INDEX.DAT File viewer:

http://www.exits.ro/index-dat-viewer.html

Install it for yourself. Now browse to the following directories and one at a time, copy the INDEX.DAT files to a temporary directory from your daughter's. INDEX.DAT files are NOT deleted when the cache is cleared by the user.

c:\Documents and Settings\USERNAME\Local Settings\History\

also do the same for Temporary Internet Files and Cookies

Using the tool above, you will be able to view all of the sites your daughter has visited with date and time stamp. Further, you can export to a CSV file which can be imported into Excel for easier manipulation and viewing.

The time stamp is in GMT (Greenwich Mean Time) which means you have to correct for your location (ie: to correct to EST - subtract 5 hours from GMT; to correct for EDT - subtract 4 hours from GMT).

HTH

Cyberruk

Type: about:cache in the address bar in Firefox or Mozilla to see if it turn up something

Wow, I didn't know about the index.dat files. Thanks for telling me about them Cyberruk and the cool index.dat viewer.

The index.dat viewer will add or alter three registry keys and your "Spyware" app may also pick certain objects up as such, if you have run this programme. Also, I presume you use XP - this app is only supported under Windows in any case;

"http://www.superwebsearch.com/ie/" will be added to the keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search
(Value:SearchAssistant)

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search
(Value:SearchAssistant)

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
(Value:Search Page)

Just thought you may need to know this.

why install software containing spyware/adware when you can use a windows port of strings to get all the info you need?

C:\DOCUME~1\tedob1\APPLIC~1\Mozilla\Firefox\Profiles\aiw5uwab.default>strings history.dat>hist.txt

this will dump the entire contents of the history.dat file or any dat file for that matter into a text file

http://cyberside.dyn.ee/freesoft/unix.htm

For reading .dat files (if you are on a budget like most of us)
use Pasco from foundstone. It does the trick very easily.
http://www.foundstone.com/index.htm?...desc/pasco.htm

Tedob also has the right idea, but if you are going to go ahead and get strings, might as well get a lot more at the same time. unxutils.sf.net has a bunch of goodies. just toss it in to your %PATH% and you've got basic *nix functionality. It's a lot smaller than M$ SFU, and cleaner than cygwin.

For those of you *nix junkies like me, go here, and get some of the foundstone proggies in source.
http://sourceforge.net/project/showf...ease_id=152410

Thanks hog...great tool, thanks for the tip. They have a decent whitepaper called Forensic Analysis of Internet Explorer Activity Files located there as well http://www.foundstone.com/pdf/wp_index_dat.pdf for anyone out there who's interested.

Are you guys sure that the index.dat files etc will help here? I mean isn't he using Mozilla?