Elective: Browser & Email Forensics — Digital Footprints of User Activity

Prerequisites

• DFA-K003: NTFS Forensics
• DFA-K004: Registry Forensics

Why This Lesson Matters

The most common forensic question in insider threat, fraud, and data exfiltration cases is simple: "What did this person actually do?" Browser history, email artefacts, and network captures answer exactly that. This elective card covers the artefact locations and analysis techniques that answer it.

1. Browser Forensics

Modern browsers store an astonishing amount of user activity in SQLite databases. These files persist on disk and survive browser cache clearing.

1.1 Artefact Locations

Chrome / Edge (Chromium-based):

%UserProfile%AppDataLocalGoogleChromeUser DataDefault
  History          → visited URLs, search terms, downloads
  Cookies          → session cookies (may still be valid)
  Login Data       → saved passwords (AES-encrypted with DPAPI key)
  Web Data         → autofill entries
  Bookmarks        → JSON file
  Cache           → cached web content (images, scripts, pages)

Firefox:

%UserProfile%AppDataRoamingMozillaFirefoxProfiles<random>.default
  places.sqlite    → history + bookmarks
  cookies.sqlite   → cookies
  logins.json      → encrypted saved passwords
  key4.db          → DPAPI-equivalent key

1.2 Extracting Browser History

# SQLite CLI query on Chrome History
sqlite3 History "SELECT datetime(last_visit_time/1000000-11644473600, 'unixepoch'),
                        url, title, visit_count
                 FROM urls
                 ORDER BY last_visit_time DESC LIMIT 50;"

# Python with pandas
import pandas as pd, sqlite3
conn = sqlite3.connect("History")
df = pd.read_sql_query("""
    SELECT datetime(last_visit_time/1000000-11644473600,'unixepoch') as visited_at,
           url, title, visit_count
    FROM urls ORDER BY last_visit_time DESC
""", conn)
print(df.head(20))

Note: Chrome's time format is microseconds since 1601-01-01 (Windows FILETIME). The - 11644473600 conversion adjusts to Unix epoch.

1.3 Browser Cache as Evidence

The browser cache contains downloaded files, page content, and images — even if the user cleared their browsing history.

# Extract Chrome cache
python3 -m chromedb extract --input "Cache/" --output /cases/IR-001/cache/

# Or use ChromeCacheView (NirSoft) on Windows
# Shows every cached item with URL, file type, last modified time

2. Email Forensics

2.1 Outlook PST / OST Files

Outlook stores email in PST (Personal Storage Table) or OST (Offline Storage Table) files.

PST: %UserProfile%DocumentsOutlook Files*.pst
OST: %UserProfile%AppDataLocalMicrosoftOutlook*.ost

# Parse PST offline (Linux)
readpst -o /cases/IR-001/email_export/ suspect.pst
# Creates folders for each mailbox folder; emails as .msg or .eml files

# Index and search the exported emails
grep -r "wire transfer|bitcoin|password" /cases/IR-001/email_export/ --include="*.eml"

2.2 PCAP SMTP Evidence

When email is transmitted over unencrypted SMTP, the full session — headers, body, attachments — is visible in a PCAP.

# Extract all SMTP sessions from a PCAP
tshark -r capture.pcap -Y "smtp" -T fields 
  -e frame.time -e smtp.req.command -e smtp.req.parameter

# Follow a specific SMTP stream to read the full email
tshark -r capture.pcap -Y "smtp" -T fields -e tcp.stream | sort -u | head
tshark -r capture.pcap -q -z follow,tcp,ascii,<stream_id>

# Export all SMTP objects (attachments)
tshark -r capture.pcap --export-objects imf,/cases/IR-001/smtp_exports/

What to look for in an SMTP session:

3. Windows Mail Artefacts

Even if email was web-based (Gmail, Outlook 365), artefacts remain:

Browser history:     gmail.com visits with timestamps
Browser cache:       cached email content
TypedURLs registry:  mail.google.com, outlook.live.com in NTUSER.DAT
Download folder:     attachments saved to disk
Windows Search:      %ProgramData%MicrosoftSearchDataApplicationsWindows
                     → may contain indexed email content

4. Common Mistakes

Mistake 1: Treating "browser history cleared" as "no evidence." Cache, cookies, download history, and SQLite databases may survive a clear history operation. Each database must be individually checked.

Mistake 2: Not checking the downloads table. The Chrome History database contains a downloads table — every file downloaded including URL, filename, file size, and partial SHA-256. Even if the file was deleted from disk, the download record remains.

Mistake 3: Ignoring web-based email in browser artefacts. A suspect who used Gmail entirely leaves evidence in Chrome History (URLs with timestamps), Chrome Cache (email content fragments), and potentially Chrome Login Data.

5. Practice Exercises

1. Chrome History shows a visit to https://wetransfer.com/downloads/a3f9b2c1 at 14:45 UTC. How do you determine what was downloaded? Where else do you look?

2. An SMTP PCAP session shows RCPT TO: [email protected] and then a base64-encoded attachment. Describe the steps to recover the attachment file.

3. A user claims they never visited a suspicious website. Chrome History is empty (cleared). List three other artefact locations that may still show the visit.

6. Lab

Assessment mode: flag

challenge_spec_id: 279 — PCAP SMTP email interception

You are given a capture.pcap containing an SMTP session.

Task: 1. Follow the SMTP TCP stream 2. Extract the email Subject line 3. Decode the base64 attachment body 4. The flag is inside the decoded attachment

7. Framework Alignment

8. Further Reading

• NirSoft Browser Forensics Tools — BrowsingHistoryView, ChromeCacheView, MozillaCacheView
• Hindsight — https://github.com/obsidianforensics/hindsight — Chrome forensics tool in Python
• readpst — Included in libpst package; the standard PST extraction tool

["Query a Chrome SQLite History database to extract the 20 most recent URLs with their visit timestamps, converting Chrome FILETIME to readable UTC format", "Follow an SMTP TCP stream in a PCAP to extract the From, To, Subject, and base64 attachment, and decode the attachment to recover the original file", "List four browser artefact locations that survive a 'clear browsing history' operation and explain what evidence each preserves"]

Prerequisites → Why this matters → Browser forensics (artefact locations for Chrome/Firefox, SQLite queries, cache extraction) → Email forensics (PST/OST with readpst, SMTP PCAP analysis) → Windows email artefacts in browser/registry → Common mistakes → Practice exercises → Lab (flag, spec 279) → Framework alignment → Further reading