Investigating Internet Explorer Web Browser
30/04/2021 Friday
Internet Explorer is a web browser developed by Microsoft Corporation. It is one of the most known browsers as it was the default web browser for Windows devices from 1995 till January 2015. The Internet Explorer project was started in 1994 as part of an Internet Jumpstart Kit then over time it has gradually developed till reached its latest version Internet Explorer 11. Internet Explorer is available for Windows desktop and was previously available on macOS and UNIX.
Digital Forensics Value of Internet Explorer Artifacts
Web browsers’ data can be critical to a digital investigation since they serve as a user's window and access point to the web and the rest of the world. Web browsers have become part of our daily lives, thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.
Location of Internet Explorer Artifacts
Versions 4 to 9 of Internet Explorer stores its Internet browsing activity in index.dat files in the following locations based on the user’s operating system.
Windows Vista 7, 8 and 10:
C:\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
C:\Users\%username%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5
C:\Users\%username%\AppData\Local\Microsoft\Windows\History\Content.IE5
C:\Users\%username%\AppData\Local\Microsoft\Windows\History\History.IE5
C:\Users\%username%\AppData\Local\Microsoft\Windows\History\Low\History.IE5
C:\Users\%username%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist01yyyymmddyyyymmdd
C:\Users\%username%\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist01yyyymmddyyyymmdd
C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache
C:\Users\%username%\AppData\Local\Microsoft\Internet Explorer\Recovery
C:\Users\%username%\AppData\Local\Temp\Low\Cookies
C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Cookies
C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Cookies\Low
C:\Users\%username%\AppData\Roaming\Microsoft\Windows\IEDownloadHistory
C:\Users\%username%\AppData\Roaming\Microsoft\Internet Explorer\UserData
C:\Users\%username%\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low
C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache\
C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PrivacIE\
C:\Users\%username%\AppData\Roaming\Microsoft\Windows\PrivacIE\Low
C:\Users\%username%\Favorites
Windows 2000 and XP:
C:\Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\%username%\Local Settings\History\history.IE5
C:\Documents and Settings\%username%\Local Settings\History\history.IE5\MSHist01yyyymmddyyyymmdd
C:\Documents and Settings\%username%\Cookies
Windows 95 and 98:
C:\Windows\Cookies
C:\Windows\History\History.ie5
C:\Windows\Temporary Internet Files\Content.ie5
Structure of Internet Explorer Artifacts
Internet Explorer version 4.0 to 9.0 stores each of its content, such as cache, history, cookies, feeds, and favorites in separate database files known as index.dat.
Analyzing Internet Explorer Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to analyze Internet Explorer artifacts from Windows machines and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Internet Explorer artifacts:
ArtiFast can analyze Internet Explorer cache, cookies, cookie records, favorites, main history, daily history, weekly history, leak records, privaciE records, redirect records, and feedplat records. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Internet Explorer artifacts in ArtiFast software.
Internet Explorer Cache Artifact
This artifact contains the cached entries in Internet Explorer web browser. The details you can view include:
- Last Checked by Local Host Date/Time - The date and time the cached entry content was checked for recency on the local system.
- Last Modified by Web Server Date/Time - The date and time the cached entry content was modified on the webserver.
- Located At - Located at.
- URL -The URL of the cache record.
- Cache Retrieval Count - The number of times the cache record was requested.
- User -The local user.
- File Name -The name of the file.
- File Type -The type of the cache file.
- File Size - The size of the cache file.
- Temporary Folder Name - The temporary folder name.
Internet Explorer Cookies Artifact
This artifact contains information about all the cookies in Internet Explorer web browser. The details you can view include:
- Created Date/Time - The date and time the cookie was created.
- Expiration Date/Time - The date and time the cookie expires.
- Host - The host domain of the cookie.
- User Name - User name.
- Name - The name of the cookie.
- Value - The value of the cookie.
- Path - The path to the cookie.
- Flags - Maximum age in seconds or optional flags.
Internet Explorer Cookies Records Artifact
This artifact contains information about the cookies records in Internet Explorer web browser. The details you can view include:
- Last Modified by Web Server Date/Time - The date and time the URL record was modified on the webserver.
- Last Accessed Date/Time - The date and time the URL was last accessed.
- Located At - Located at.
- URL - The URL that created the cookie.
- User - User.
- Visit Count - The number of times the URL was visited.
- Related TXT Cookie File - Related TXT Cookie File.
Internet Explorer Favorites Artifact
This artifact contains information about the web pages that the user has set as a favorite. The details you can view include:
- File Last Modified Date/Time - The date and time the favorite file was last modified.
- File Last Access Date/Time - The date and time the favorite file was last accessed.
- File Created Date/Time - The date and time the favorite file was created.
- Title - The title of the webpage.
- Internet Shortcut URL - Internet shortcut URL.
- Icon File - The icon file.
- Default Base URL - The default base URL.
Internet Explorer Feedplat Records Artifact
This artifact contains information about the feedplat records in Internet Explorer web browser. The details you can view include:
- Feedplat Date/Time - Date and time of the Feedplat.
- Located At - Located at.
- URL - The visited URL.
- File Name -The name of the file.
- Value - Value.
Internet Explorer Leak Records Artifact
This artifact contains information about the browser history records that are scheduled for deletion. The details you can view include:
- Last Modified Date/Time - The date and time the URL record was last modified.
- Last Accessed Date/Time - The date and time the URL record was last accessed.
- Located At - Located at.
- URL - The visited URL.
- Visit Count - The number of times the URL was visited.
Internet Explorer Main History Artifact
This artifact contains information on the websites that a user visits using Internet Explorer. The details you can view include:
- Last Visited Date/Time - The date and time when the webpage was last visited.
- Located At - Located at.
- URL - The URL of the visited webpage.
- User - User.
- Visit Count - The number of times the URL was visited.
- Web Page Title - The web page title.
- Favicon URI - Favicon URL.
- Last Visited (2nd Timestamp) Date/Time - The second timestamp for the last visited webpage.
Internet Explorer Daily History Artifact
This artifact contains information on the daily history in Internet Explorer web browser. The details you can view include:
- Last Visited Date/Time - The date and time when the webpage was last visited.
- Located At - Located at.
- URL - The URL of the visited webpage.
- User - User.
- Last Visited (Local Time) Date/Time - The date and time when the webpage was last visited in local time.
- Visit Count - The number of times the URL was visited.
Internet Explorer Weekly History Artifact
This artifact contains information about the weekly history of the user’s visited websites using Internet Explorer web browser. The details you can view include:
- Last Visited (Local Time) Date/Time - The date and time when the webpage was last visited in local time.
- Located At - Located at.
- URL - URL of the webpage.
- User - User.
- Weekly History File Created Date/Time - The date and time when the weekly history file was created.
- Visit Count - The number of times the URL was visited.
Internet Explorer PrivacIE Records Artifact
This artifact contains information on the websites that a user visits while having the privacy settings turned on. The details you can view include:
- Last Modified Date/Time - The date and time when the record was last modified.
- Last Accessed Date/Time - The date and time the cookie record was last accessed.
- Located At - Located at.
- URL - URL of the webpage.
- Visit Count - The number of times the URL was visited.
Internet Explorer Redirect Records Artifact
This artifact contains information about the visits that were a result of a redirect operation. The details you can view include:
- File Last Modified Date/Time - The date and time when the file was last modified.
- Located At - Located at.
- URL - URL of the webpage.
