Investigating browser history

Browsers can contain a lot of useful data. By analyzing the browser history, we can understand what sites the user visited, what search queries user performed, and what files were downloaded. Even if a private mode or a special browser (for example, Tor Browser) was used to surf the internet, we can still find useful information in memory.

The following screenshot shows the output of the pslist plugin, where we can see several processes related to Google Chrome, Mozilla Firefox, and Tor Browser:

Figure 4.12 – Browser-related processes

So, how do you get information about the visited resources? There are several ways to do this:

• Export the process memory and process it with the Strings utility (https://docs.microsoft.com/en-us/sysinternals/downloads/strings), which allows you to get the list of ASCII and Unicode symbols from various files.
• Export the process memory and process it with bulk_extractor (https...