Forensic Analisys of Web Browser With Dual Layout Engine (Slides - Linda - ICDFI2012)

Forensic Analysis of
Web Browser with Dual

Layout Engine
Linda Zhong
Market share of Web
browsers in China
Chinese Web Browsers
Maxthon 2
Tencent Traveler(updated to
version 6 with the new name QQ
Browser)
TheWorld
360 Security Browser
They all used IE Trident engine, i.e. all

log files left are IE artifacts which can
be analyzed by every web browser
forensics tools
Recent Chinese Web
Browsers
Use the new layout engine

Most of them have two access
modes:
Fast mode: bases on IE Trident
engine
Compatibility mode: uses WebKit
or Chromium engine (Webkit also
used by iOS and Android)
Recent Chinese Web
Browsers
QQ Browser, Maxthon 3 and
Sougou Explorer use the IE and
WebKit engines
360 Chrome and CoolNovo are
based on the IE and Chromium
engines
• Artifacts left by IE engine can be collected by

forensic tools
• How about the artifacts generated by Webkit?
Why dual engine?
 Some web sites in China must be accessed
by installing security plug-ins or add-ons,
especially for banks and governments
 Plug-in or add-ons only support IE
What can we do in
forensics analysis?
Collection – Where to collect
XP：
 C:\Documents and Settings\[User]\ApplicationData\[Application name]
 C:\Documents and Settings \ [User] \Local Settings\Application
Data\[Application name]
 Installed path
Vista/7:
Webkit:
C: \ [User] \AppData\Roaming\[Application
Name]
Chromium:
C: \ [User] \AppData\Local\[Application Name]
Don’t Forget to collect IE artifacts
Collection – What to collect?
Favorite
Cookies
History
Download lists
More
Most of log files are in sqlite3
format
Analysis – Timeline Analysis
3 types of time stamps:
Readable time format
2012-01-01 00:00:00(history records of Sougou Explorer)
Webkit time format

microseconds (10-6) since January 1 1601 00:00:00(UTC)
UNIX time format

seconds since January 1, 1970
00:00:00(UTC)
 Don’t forget the time zone
Readable timestamp - Sougou
Explorer history records
Webkit Timestamp
Webkit timestamp is the

microseconds (10-6) since
January 1 1601 00:00:00(UTC)
which is widely used in Chinese
Web Browsers
Analysis - Finding Searching
Words
 Why? Search words are evidence of the
suspect’s efforts to gather information for his
crime and may specify the purpose, target
and methods of the crime
 Log file - 360 Chrome and
CoolNovo/ChromePlus
 History file - HTTP URL structure
http:// Host Port / Path ? Search part(Variable= Value)*
For example:
Baidu searsh:
Host = Baidu.com
Path=s
Variable=wd
Analysis – Data Recovery
 3 ways to delete data in sqlite3 files

Overwritten with zeros Difficult to recover
To delete the area itself
To set the data area as free
 Other formats usually deleted themselves
Possible to recover
 These web browsers support function that
auto-erase after every exit
Deleting log files of
Chinese web browsers
Cache(F Download
Web browser History Cookies list
older)
Sougou Overwriting Overwriting Overwriting
Deleted
Explorer by zero by zero by zero
Overwriting
Maxthon 3 N/A Deleted Deleted
by zero
Overwriting Overwriting
QQ Browser Deleted deleted
by zero by zero
Overwriting Overwriting Overwriting
360 Chrome Deleted
by zero by zero by zero
CoolNovo/Ch Overwriting Overwriting Overwriting
Deleted
romePlus by zero by zero by zero
Analysis – Useful Logs
 My Favorite Sites/Most Accessed Sites
 Recently Closed Sites
 Contain more time attributes
 Both can be deleted with function auto-
erase
 Special logs
 contain forensic-sensitive information but
can’t be deleted by erase function.
 based on understanding the structures of
all the logs.
 but not every browser has special logs
 For example, backups and crash logs
Where are they?
Recently
Web My favorite
closed Favorite
browser web sites
pages
Sougou
HistoryUrl.db HistoryUrl.db Favorite2.dat
Explorer
Maxthon 3
- Lasttab.dat Favorite.dat
QQ Browser {ED81EB6C-
3DC4-4322-
recent_closed
96F1- Bookmarks
_tab.db
1B8716C404C4}
.db
360 Chrome Top Sites - Bookmarks
CoolNovo/
ChromePlus Top Sites - Bookmarks
Analysis – Special Log Files
 Sougou Explorer – History log is uhistory.db that
will be deleted by manual or auto-erase
Table UserRankUrl (id char(512) primary key,
title char(100),
keyfactor int,
hit int,
deleteflag int,
oftenfactor int,
titleLock int
last datetime,
reserved int
);
The table is used to record all the web sites which the user
visited. It will create the new record if the user visits a new
web site and update the last accessed time if the user visits a
existed page.
Future Work
 Exact user name, password and other
information from Magia Fill
 Correlation analysis between several
browsers
 To reconstruct web pages from cache
Questions?
Ask Linda Zhong

Forensic Analisys of Web Browser With Dual Layout Engine (Slides - Linda - ICDFI2012)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Forensic Analisys of Web Browser With Dual Layout Engine (Slides - Linda - ICDFI2012)

Uploaded by

Copyright:

Available Formats

Forensic Analysis of

Web Browser with Dual

They all used IE Trident engine, i.e. all

Use the new layout engine

• Artifacts left by IE engine can be collected by

Webkit time format

UNIX time format

Webkit timestamp is the

 3 ways to delete data in sqlite3 files

Ask Linda Zhong

You might also like