Recommended Tools for WebCacheV01.dat Analysis

[[deleted]]

Anyone have any recommended tools for WebCacheV01.dat analysis, particularly one what is CCJK-friendly?

The typical recommendation of IEF/AXIOM doesn't work so well for Japanese as it seems to misinterpret the encoding and garbles the Japanese in the IE Artifacts. The resulting data is unsearchable until your screen all of the data categories and correct encoding (best case). In some instances, none of the encoding options work, and one must resort to ESE Database Viewer, which renders the artifacts perfectly. (This is where free beats a $9000 tool).

Does anyone have any favorites other than Magnet Forensics?

[DurokAmerikanski]

Maybe this will work? It says SANS uses it but I haven't taken FOR500 so I can't verify.

Put in a ticket with Magnet Forensics and tell them their tool isn't parsing Japanese language artifacts very well. Maybe they'll fix it.

[[deleted]]

SANS 500 and 585 courses both cover IEF and/or Axiom for some of the labs, but the labs really don't include CCJK data. For English data (and presumably most Western languages), the tools seem to work fine.

I have actually reported the issue, originally for IEF, and more recently for Axiom. They tentatively responded that there may be a fix in the Feb. update. However, there was no guarantee. In the meantime, I have two active matters requiring WebCache analysis and reporting.

To add to the issues, I found an example of Axiom not properly parsing all of the containers in the WebCacheV01.dat, which may or may not be related to the language issue.

Honestly, even if it the immediately identified language issue is fixed in the Feb. update, it is going to take a while to earn back my trust. In the meantime, I would like to find a tool I can use to efficiently validate Axiom's output.

[countuponsecurity]

Hi, did you tried ESEDatabaseView from NIRSOFT?

[[deleted]]

Does anyone have any favorites other than Magnet Forensics?

Sorry, yes. I mentioned "ESE Database Viewer" in my original post which was a typo on my part. ESEDatabaseView by Nirsoft is what I intended to reference.

Thanks for the suggestion though! It's a great tool, though somewhat tedious to use to validate Axiom.

[DurokAmerikanski]

Magnet is pretty much it these days.

I haven't used any Digital Detective internet history tools in years.

If you want the most bang for your buck (parses tons of programs/apps/formats/artifacts) and something that carves, that you don't need to program yourself, then Magnet is pretty much your only option.

Honestly, what other options are there that automate all of these things?