NetAnalysis v1.53 Released

Posted by Robert Rutherford on October 7th, 2011 under , , ,
Forensic Analysis

This is an important release of NetAnalysis which fixes a number of issues in relation to the changes implemented in the latest browsers.

All of the main browsers, Internet Explorer, Mozilla Firefox, Google Chrome, Apple Safari and Opera, have either made changes to their file formats or added additional new features.  These changes have necessitated a considerable amount of research, development and testing to add the required support.  This document outlines some of the changes with this release.

Apple Safari
This release has been tested with Apple Safari up to version 5.1.7354.50.  Safari has introduced a number of changes to the cache structure which is not supported in earlier versions of NetAnalysis.

Google Chrome
This release has been tested with Google Chrome up to version 14.0.835.202.  A modification in the cache in relation to the way digital certificates are stored introduced an error in NetAnalysis v1.52 when importing the cache.  This has now been resolved.

Microsoft Internet Explorer
This release has been tested with Microsoft Internet Explorer up to version 9.0.8112.16421.  Internet Explorer 9 introduced a new integrated download manager which stores the details of downloaded files in a new download INDEX.DAT file.  This file has a different structure to the standard INDEX.DAT files.  Figure 1 shows NetAnalysis 1.53 with a Download INDEX loaded.  You can see the original URL and Download Path columns.

Internet Explorer Downloads NetAnalysis

Figure 1

Mozilla Firefox
This release has been tested with Mozilla Firefox up to version 7.0.1.  Mozilla has been on a mission recently and has released version 4 to 7 of their browser in a very short time frame.  Version 4 saw a significant change to the structure of the cache as well as the structure for storing cached files on disk.  We have also added support for the signons database.

Opera
This release has been tested with Opera up to version 11.51.  Opera is another browser which has made changes to the structure of their cache file and disk layout.

Other New Features
In addition to the main five browsers, we have also tested this release against Sundial browser, version 4.0.1.  To see a full list of all the changes, please see the following:

Published by Robert Rutherford

Comments are closed.