All those of you who think that FireFox is the most secure browser as compared to others are not wrong! You are right! It is the most secure browser only when it comes to browsing. But, as most software’s are flawed in one way or the other, FireFox also suffers from a flaw.
The flaw not exactly FireFox’s flaw, exists when it stores your history in SQLite databases. When you clear your history, this data can be recovered unless, the free space has be over written with data. ff3hr is a forensic tool to recover deleted history records from Firefox 3 by searching and recovering records from four different tables in an whole disk image. ff3hr stands for FireFox 3 History Recoverer. It is a command line tool that can analyse uncompressed disk images to discover traces of the four SQLite tables:
- moz_historyvisits
- moz_places
- moz_formhistory
- moz_downloads
Information in these tables is encoded using Huffman algorithm. This tool recovers records from the above databases and reports the results in following output files:
- ff3hr-mozplaces.txt
- ff3hr-mozhistoryvisits.txt
- ff3hr-mozformhistory.txt
- ff3hr-mozdownloads
ff3hr - The FireFox 3 History Recoverer!
ff3hr will prove ineffective if FireFox is been loaded from a read only device. It can play an important in your Windows forensics arsenal as it requires no installation! Another problem with the working of this tool is that it needs a disk image for processing. You can use tools that aide you in creating disk images like ftk imager, dcfldd, etc.
This tool is open source and has been programmed in C++. With little tweaking, this tool can be made backward compatible with version 3.4 and below.
You can download this tool here.
Searches leading to this post:ff3hr, orensic analysis of the Firefox 3 internet history and recovery of deleted SQLite records, how to use Firefox 3 History Recovery, firefox history recover, Firefox 3 History Recovery o ff3hr tutorial, Firefox 3 History Recovery, ff3hr-mozplaces txt, ff3hr windows 7, FF3HR firefox, recover firefox history tutorial
You must log in to post a comment.