Advanced Internet Browser Forensics - Using CacheBack®

download syllabus  |  register now!

This advanced SiQuest training course provides the knowledge and skills necessary to use CacheBack to recover and analyze Internet artifacts from today's top leading browsers. Participants will learn how to decode cache entries and rebuild web pages using CacheBack, as well as, perform advanced data queries and analysis. During this three-day hands-on course, participants perform the following tasks: Use CacheBack to examine and analyze History and Cache artifacts from: Microsoft Internet Explorer Mozilla Firefox (Version 2 and 3) Safari Opera Google Chrome

Our First CacheBack Course held in Orlando, Florida USA - December 8-11, 2009 From left to right: Kevin Stenger, Sandy Cawn, Francis Dufresne, John Bradley (instructor), Eric Walton, Ed Hughes, Charlie Troell, Debra Healy, Erik Zabik, Dan Purcell

• Use CacheBack to parse the following particular Cache and History file types:
  • index.DAT files used by Internet Explorer (History, Temporary Internet Files)
  • history.dat (mork database format) for Firefox 2
  • _CACHE_MAP_, _CACHE_001_, _CACHE_002_ and _CACHE_003_ (Firefox 2/3)
  • index, data_0, data_1, data_2, and data_3 (Google Chrome)
• Use CacheBack to perform advanced analysis that includes:
  • Structure Query Language (SQL) syntax in creating and saving advanced custom queries.
  • Understanding Hypertext Markup Language (HTML) and the use and meaning of query parameters in URLs.
  • Identifying HTML elements that can be used as search (GREP) expressions for custom queries.
  • Validation of cache record entries using independent third party tools (eg: hex editors, online converters).
• Participants will be shown:
  • Decipher the cache mapping systems for Firefox and Google Chrome
  • How to create and manage custom queries using the new Query Builder
  • How to rebuild web pages and use advanced Link Analysis to zero-in on user activity
  • How to create compelling, rich HTML reports (Graphical and Tabular formats)
• During the course, students will be provided a case scenario involving sample data from all five browsers. The participants will leverage all features of CacheBack to produce and publish sample reports for disclosure.

Prerequisites

This hands-on course is intended for forensic investigators, law enforcement personnel, and security and network administrators who are, or are considering using CacheBack for their investigation of Internet cache and history data.

To obtain the maximum benefit from this course, you should meet the following requirements:

• Read and understand the English language.
• No previous experience of CacheBack required.
• Have previous experience in forensic investigations.
• Have a working knowledge of the latest versions of Internet Explorer, Firefox, Opera, Safari and Google Chrome.

Course Materials and Software

You will receive the student training manual and CD containing lab exercises and course-related information.

Click here to download the 3-day course syllabus (PDF Format).