Auto-Complete Data

AutoComplete data in web browsers provides a rich source of information for digital forensics and incident response professionals. This data, generated by users as they fill out forms and search fields on the web, is stored locally by browsers to enhance the user experience by predicting and filling in information in similar forms in the future. Here's an overview of how AutoComplete data is stored across different browsers and its forensic implications.

Mozilla Firefox

Location of AutoComplete Data:

• Form History: %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\formhistory.sqlite

• Places Database: %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\<randomtext>.default\places.sqlite

The formhistory.sqlite database stores information that users have entered into web forms, while places.sqlite contains records of URLs, including those typed into the address bar, enhancing the browser's ability to autocomplete URLs based on partial user inputs.

Google Chrome and Microsoft Edge

History:

• Chrome: %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\History

• Edge: %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\History

These History files contain URLs that have been visited, search queries, and may also include titles of visited web pages, facilitating a predictive typing feature for URLs and search queries.

Web Data (Chrome and Edge):

• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Web Data

• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Web Data

The Web Data file is critical for storing AutoComplete information related to web forms, including names, addresses, search terms, and other entries made by the user.

• Shortcuts and Network Action Predictor:

  • These files store information related to frequently visited websites and are used to predict user actions based on their browsing habits.

• Login Data:

  • Chrome: %USERPROFILE%\AppData\Local\Google\Chrome\User Data\<Profile>\Login Data

  • Edge: %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\<Profile>\Login Data

The Login Data files are particularly sensitive, as they contain information related to websites where the user has entered a username and password, potentially including encrypted passwords.

Forensic Implications

The forensic analysis of AutoComplete data can reveal:

• User behavior and interaction with specific websites.

• Potential credentials and sensitive personal information.

• Patterns that may help in understanding a user's habits or intentions.

Analyzing these files requires specialized tools and knowledge of database structures to interpret the data correctly. It's crucial to handle this data with care due to its potential sensitivity and the ethical and legal considerations involved in accessing personal information. A tutorial is coming soon!