Opera Blog

Investigating Opera Web Browser

10/09/2021 Friday

Opera is a multi-platform web browser developed by Opera Software. Opera Web browser is known for its small size, speed and stability. The web browser is available for desktop (Windows, macOS, and Linux) and mobile devices (Android and iOS).

Digital Forensics Value of Opera Artifacts

Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives; they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.

Location of Opera Artifacts

Opera web browser stores its files and folders at the following location: C:\Users\%username%\AppData\Roaming\Opera Software\Opera Stable

Except for the cache as it can be found at: C:\Users\%username%\AppData\Local\Opera Software\Opera Stable\Cache

Structure of Opera Artifacts

The majority of Opera web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as Opera autofill, history, and downloads; however, some of the artifacts are stored within JSON files such as Opera bookmarks.

Analyzing Opera Artifacts with ArtiFast Windows

This section will discuss how to use Artifast Windows to extract Opera browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select Opera web browser Artifacts:

ArtiFast can analyze Autofill, Bookmarks, Cache, Cookies, Current Session, Last Session, Downloads, Extension Cookies, Favicons, History, Login Data, and Thumbnails. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.

Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Opera artifacts in ArtiFast software.

Opera Autofill Artifact

Opera Autofill contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:

Created Date/Time - The Date/Time when the autofill was created.
Last Used Date/Time - The Date/Time when the autofill was used.
Name - The name of the field to fill in.
Value Lower - Value lowercase.
Value - The value typed by the user.
Count - Indicates the number of times the input was used.
Row Id - Row Id.

Opera Bookmarks Artifact

Opera Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:

Date/Time Added - The Date/Time when the bookmark was added.
Date/Time Modified - The Date/Time when the bookmark was modified.
URL - The URL of the bookmarked webpage.
Bookmark ID - The bookmark ID.
Bookmark Type - The type of the bookmark.
Bookmark Title - The title of the bookmark.

Opera Cache Artifact

This artifact contains the cached entries in the Opera web browser. Opera Cache information includes:

Creation Date/Time - The Date/Time when the cached entry was created.
Last Used Date/Time - The Date/Time when the cached entry was last used.
Last Modified Date/Time - The Date/Time when the cached entry was last modified.
Reuse Count - Cache entry reuse count.
State - The state of the cache file.
Key - Represents the profile picture URL.
Content Size - The size of the cache file.
Content Type - The type of cache file.
File Name - Represents the cache file name.
Payload - Indicates the cache storage location.
Is Dirty - Indicates whether is dirty or not.
Refetch Count - Cache entry refetch count.
Long Key Data - Cache long key data.
HTTP Content - HTTP header content.

Opera Cookies Artifact

Opera Cookies contains information about all of the cookies saved to the browser such as:

Creation Date/Time - The Date/Time when the cookie was created.
Expiration Date/Time - The Date/Time when the extension cookie will expire if it was set to expire.
Last Access Date/Time - The Date/Time when the cookie was last accessed.
Host Key - The host domain of the cookie.
Name - The name of the cookie.
Value - The value of the cookie.
Path - The path to the cookie.
Secure - Indicates whether the connection is secure or not.
HTTP Only - Indicates whether the browser supports HTTP Only or not.
Has Expiration Date - Has expiration date.
Firstparty Only - Indicates whether it has first party only.
Encrypted Value - Encrypted value.
Persistent - Persistent.
Priority - Priority.
Database Row ID - Database row Id.

Opera Current Session Artifact

This artifact stores the browser's current available active session information from Opera web browser such as:

Date/Time Visited - The Date/Time when the webpage is visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Request URL - Indicates whether a redirect took a place.
Tab Id - The webpage tab ID.
Tab Index - The webpage tab index.
Transition Type - Describes the cause of the navigation to the desired URL.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Opera Downloads Artifact

The artifact contains the downloads information from Opera web browser. The details you can view include:

Start Date/Time - The Date/Time when the item started downloading.
End Date/Time - The Date/Time when the download ended.
Last Modified Date/Time - The Date/Time when the download was last modified.
File Name - The name of the downloaded file.
ID - Download Id.
Current Path - The current path.
Target Path - The target path.
Referrer - The referrer URL.
Download Source - The URL of the file that was downloaded.
Received Bytes - The bytes that were downloaded.
Total Bytes - The file size of the download.
Row Id - Row Id.
Is Opened by User - Indicates whether the user has opened the downloaded file or not.
State - It indicates the state of the downloaded item (Download Complete, Download in Progress/Paused, Download Failed and Download Interrupted/Cancelled).
Interrupt Reason - The download interruption reason.
MIME Type - MIME Type.
Original MIME Type - Original MIME Type.

Opera Extension Cookies Artifact

The artifact stores the cookies used by the extensions. The details you can view include:

Creation Date/Time - The Date/Time when the extension cookie was created.
Expiration Date/Time - The Date/Time when the extension cookie will expire if it was set to expire.
Last Access Date/Time - The Date/Time when the cookie was last accessed.
Host Key - The host name of the cookie.
Name - The name of the cookie.
Path - The path to the cookie.
Priority - Indicates the priority of the extension cookie.
Value - The value of the cookie.
Encrypted Value - The value of the cookie encrypted.
Firstparty Only - Indicates whether it has first party only.
Has Expiration Date - Indicates whether it has an expiration date or not.
HTTP Only - Indicates whether the browser supports HTTP Only or not.
Persistent - Indicates whether it is persistent or not.
Secure - Indicates whether the connection is secure or not.
Database Row Id - Database row Id.

Opera Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:

Last Update Date/Time - The last Date/Time the favicon was updated.
Last Requested Date/Time - The last Date/Time the favicon was requested.
Favicon URL - The page URL of the favicon.
Icon Mapping Page URL - The icon URL of the favicon.
Favicon Bitmap Height - Favicon bitmap height.
Favicon Bitmap Width - Favicon bitmap width.
Image Data - Image data.
Located At - Located at.

Opera History Artifact

The artifact contains the web browser history data. The details you can view include:

Visit Date/Time - The Date/Time when the webpage was visited.
Last Visit Date/Time - The Date/Time when the webpage was last visited.
URL - The URL of the visited webpage.
Page Title - The title of the visited webpage.
Visit Duration in Seconds - Visit Duration in Seconds.
Visit Count - The number of times that the user has visited the webpage.
Typed Count - The number of times that the user has manually typed the webpage URL.
Transition - Describes the cause of the navigation to the desired URL.
Segment ID - The segment Id.
Is Hidden - Indicates whether the webpage is hidden.
From Visit - From visit.
Favicon ID - Favicon Id.
Database Row ID - Database row Id.

Opera Last Session Artifact

This artifact stores the browser’s previous session information from Opera web browser. The details you can view include:

Date/Time Visited - The Date/Time when the webpage was last visited.
Tab URL - The URL of the webpage.
Tab Title - The title of the webpage.
Transition Type - Describes the cause of the navigation to the desired URL.
Referrer URL - If the webpage was a redirect, this attribute indicates the URL of the webpage.
Original Requested URL - Indicates whether a redirect took a place.
Tab ID - The webpage tab ID.
Tab Index - The webpage tab index.
Transition Qualifier - Describes how the browser navigated to the desired URL.
Has Post Data - Indicates whether the webpage has POST data.

Opera Login Data Artifact

The artifact stores a user’s login information. The details you can view include:

Created Date/Time - The Date/Time when the data was stored.
Synced Date/Time - The Date/Time when it synched.
Display Name - The display name.
Action URL - Login URL of the webpage.
Federation URL - Federation URL.
Origin URL - Base URL of the webpage.
Username Element - Name of the username field in the webpage.
Username Value - The username entered.
Possible Usernames - Possible usernames.
Black Listed By User - Indicates that the password is not saved for this item.
Password Element - Name of the password field in the webpage.
Password Value - The password entered.
Password Type - The password type.
Submit Element - Submit element.
Signon Realm - The sign on realm URL.
Times Used - The number of times the desired credentials were used.
Preferred - Preferred.
Scheme - Scheme.
Skip Zero Click - Skip zero click.
From Data - From data.
Icon URL - Icon URL.
Database Row ID - Database row Id.
Generation Upload Status - Generation Upload Status.

Opera Thumbnails Artifact

The artifact stores information about a user’s most frequently visited web pages such as: