Forensic analysis of the ESE database in Internet Explorer 10
Independent thesis Basic level (degree of Bachelor), 10 credits / 15 HE creditsStudent thesis
With Internet Explorer 10, Microsoft changed the way of storing web related information. Instead of the old index.dat files, Internet Explorer 10 uses an ESE database called WebCacheV01.dat to maintain its web cache, history and cookies. This database contains a wealth of information that can be of great interest to a forensic investigator. This thesis explores the structure of the new database, what information it contains, how it behaves in different situations, and also shows that it is possible to recover deleted database records – even when the InPrivate browsing mode has been used.
Place, publisher, year, edition, pages
2013. , 57 p.
WebCacheV01.dat, forensics, ESE, IE10, Internet Explorer, JETBlue, browsing history, carving, InPrivate, wdsCarve
IdentifiersURN: urn:nbn:se:hh:diva-23248OAI: oai:DiVA.org:hh-23248DiVA: diva2:635743
Subject / course
Computer science and engineering
Weckstén, Mattias, Adjunkt
Bilstrup, Urban, Adjunkt