1 |
Forensic analysis of the ESE database in Internet Explorer 10Malmström, Bonnie, Teveldal, Philip January 2013 (has links)
With Internet Explorer 10, Microsoft changed the way of storing web related information. Instead of the old index.dat files, Internet Explorer 10 uses an ESE database called WebCacheV01.dat to maintain its web cache, history and cookies. This database contains a wealth of information that can be of great interest to a forensic investigator. This thesis explores the structure of the new database, what information it contains, how it behaves in different situations, and also shows that it is possible to recover deleted database records – even when the InPrivate browsing mode has been used.
|
Page generated in 0.0208 seconds