Blog >> Opera

Investigating Opera Web Browser

10/09/2021 Friday

Opera is a multi-platform web browser developed by Opera Software. Opera Web browser is known for its small size, speed and stability. The web browser is available for desktop (Windows, macOS, and Linux) and mobile devices (Android and iOS).

Digital Forensics Value of Opera Artifacts

Web browser data can be critical to a digital investigation since they serve as a user's window and access point to the World Wide Web and the rest of the world as well. Web browsers have become part of our daily lives; they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.

Location of Opera Artifacts

Opera web browser stores its files and folders at the following location: C:\Users\%username%\AppData\Roaming\Opera Software\Opera Stable

Except for the cache as it can be found at: C:\Users\%username%\AppData\Local\Opera Software\Opera Stable\Cache

Structure of Opera Artifacts

The majority of Opera web browser artifacts are maintained within SQLite database files, each contains multiple tables with information regarding the users’ actions on the software. Such as Opera autofill, history, and downloads; however, some of the artifacts are stored within JSON files such as Opera bookmarks.

Analyzing Opera Artifacts with ArtiFast Windows

This section will discuss how to use Artifast Windows to extract Opera browser artifacts from Windows machines and what kind of digital forensic insights can be gained from the artifacts.

After you have created your case and added evidence for the investigation at the Artifact Parser Selection Phase, you can select Opera web browser Artifacts:

ArtiFast can analyze Autofill, Bookmarks, Cache, Cookies, Current Session, Last Session, Downloads, Extension Cookies, Favicons, History, Login Data, and Thumbnails. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.

Once ArtiFast parser plugins complete processing artifacts for analysis, they can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Opera artifacts in ArtiFast software.

Opera Autofill Artifact

Opera Autofill contains all of the values that the user has saved to fill in fields at a later date and time. The details you can view include:

Opera Bookmarks Artifact

Opera Bookmarks are the shortcuts to the favorite and bookmarked webpages. It contains information such as:

Opera Cache Artifact

This artifact contains the cached entries in the Opera web browser. Opera Cache information includes:

Opera Cookies Artifact

Opera Cookies contains information about all of the cookies saved to the browser such as:

Opera Current Session Artifact

This artifact stores the browser's current available active session information from Opera web browser such as:

Opera Downloads Artifact

The artifact contains the downloads information from Opera web browser. The details you can view include:

Opera Extension Cookies Artifact

The artifact stores the cookies used by the extensions. The details you can view include:

Opera Favicons Artifact

The artifact stores all the small icons associated with a particular webpage that the user has favorited. The details you can view include:

Opera History Artifact

The artifact contains the web browser history data. The details you can view include:

Opera Last Session Artifact

This artifact stores the browser’s previous session information from Opera web browser. The details you can view include:

Opera Login Data Artifact

The artifact stores a user’s login information. The details you can view include:

Opera Thumbnails Artifact

The artifact stores information about a user’s most frequently visited web pages such as: