PDF《Facebook : Do You Leave a Trace?》

4 _CACHE_001_ ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Mozilla/Firefox/Profiles/f0vypw 4f.default/Cache/_CACHE_001_ Unknown Mozilla Firefox?

5 _CACHE_001_ ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Mozilla/Firefox/Profiles/f0vypw 4f.default/Cache/_CACHE_001_ Unknown Google? Chrome

11 data_1 ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Google/Chrome/User Data/Default/Cache/data_1 Unknown Google? Chrome

12 data_1 ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Google/Chrome/User Data/Default/Cache/data_1 Unknown Apple? Safari

5 Cache.db ImageName/Partition 2/NONAME [NTFS]/[root]/Users/UserName/AppData/Local/Apple Computer/Safari/Cache.db SQLITE Database Browser Sent Message New Inbox Message Already Read Message Internet Explorer?

8 Full message recovery Partial message recovery Unable to recover Internet Explorer?

9 Unable to recover Unable to recover Unable to recover Mozilla Firefox?

5 Full message recovery Unable to recover Unable to recover Google? Chrome

12 Partial message recovery Full message recovery Full message recovery Apple? Safari

5 Unable to recover Unable to recover Full message recovery ? Three GmailTM accounts set up from Google? ? Three new user profiles created on Facebook? in order to have pure data Facebook? Profile Creation Virtual Machine (VM) Creation ? VM created with Microsoft? Windows 7TM Ultimate ? Original cloned

3 times to create IE?8 VM ? Process repeated for Windows? Internet Explorer? 9, Mozilla Firefox? 4, Mozilla Firefox? 5, Google? Chrome 11, Google? Chrome 12, and Apple? Safari

5 >

Methods Single Facebook? Chat Study ? One profile logged into Facebook? on each VM ? Chat initiated between

2 profiles ? One VM imaged using FTK? Imager ? Imaged loaded into Forensic Toolkit? for examination ? Repeated for each browser Simultaneous Facebook? Chat Study ? One profile logged into Facebook? on each VM ? Chat initiated between

3 profiles ? One VM imaged using FTK? Imager ? Imaged loaded into Forensic Toolkit? for examination ? Repeated for each browser Facebook? Message Study ? One profile logged into Facebook? on each VM ? One profile sent message, next profile read new inbox message, last profile read already read message ? Each VM imaged using FTK? Imager ? Imaged loaded into Forensic Toolkit? for examination ? Repeated for each browser >

Results Single Facebook? Chat Study ? Chats recovered for each tested browser (see Table

1 for locations) ? Same chat format recovered in each tested browser (see Figure 2) ? Each chat artifact gives the header and footer, transaction, contact ID, sequence ID, entered text, time and date stamp, sender, and receiver F........