keydet89 wrote:
Unfortunately, there are many organisations (certainly in the UK) that just 'dump' IEF reports out for non-technical investigators to review.
I'm not sure why they would not want to include all individual visits? Maybe to keep down the database size?
Is it a matter of "including" in the sense of the data set, or the display?
In both senses. It is not included in either their data set or their display. Their data set is an SQLite database with a table for each artefact. Because the WebHistory is extracted from multiple tables (E.G, In Chrome - URLS / VISITS) when IEF is run the program (IEF) then collates the data from these two tables into a single table within the IEF database. The viewer program then displays the data from this database and adds searching/bookmarking functionality etc.
The only way to view all of the individual visits )as far as I can see!) is to use another tool or manually pull it out using SQL.
The SQL solution was better for me because I could combine it with the results from WebData database and downloads to get a more comprehensive timeline.
Cheers
Dan
↧