Cookies

Cookies are small pieces of data stored on a user's device by web browsers to remember stateful information or record the user's browsing activity. While primarily used for session management, personalization, and tracking, cookies can also provide forensic investigators with insights into a user's internet activities, including visited websites and potentially, the physical locations accessed through those websites.

Analyzing Cookies for Physical Location

Cookies can contain information that, directly or indirectly, hints at a user's physical location. This could be through:

• Geo-location data stored by websites that request location access.

• Timezone information which can be used to infer a geographical region.

• IP addresses that can be geolocated to specific areas.

• Location-specific preferences or content settings within websites.

Cookie Locations by Browser

Internet Explorer / Microsoft Edge (Legacy)

• Windows XP: %userprofile%\Cookies

• Windows 7–10:

  • %userprofile%\AppData\Roaming\Microsoft\Windows\Cookies

  • %userprofile%\AppData\Roaming\Microsoft\Windows\Cookies\Low

Firefox

• Windows XP: %userprofile%\Application Data\Mozilla\Firefox\Profiles\<random text>.default\cookies.sqlite

• Windows 7–10: %userprofile%\AppData\Roaming\Mozilla\Firefox\Profiles\<random text>.default\cookies.sqlite

Chrome

• All Versions: %userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cookies

The cookie storage for Chrome is in a SQLite database named Cookies. Chrome does not store cookies in plain text files like Internet Explorer or older versions of browsers.

Steps to Analyze Cookies

1. Locate and Access Cookie Stores: Navigate to the file paths mentioned above based on the browser and Windows version. Use tools like Windows Explorer, command line, or forensic software to access these locations.

2. Extract Cookies Data:

   • For Internet Explorer, cookies might be stored as individual text files.

   • For Firefox and Chrome, cookies are stored in SQLite databases. You can use SQLite browser tools to open cookies.sqlite for Firefox and Cookies for Chrome.
3. Identify Relevant Cookies: Look for cookies related to specific services that use location data (e.g., mapping services, weather sites, or any service that customizes content based on location). Pay attention to cookie names that might suggest location storage or preferences.

4. Analyze Cookie Contents: Use SQL queries for SQLite databases or text editors for individual files to examine the contents of the cookies. Look for JSON strings, key-value pairs, or other data formats that contain location identifiers, IP addresses, or timezone information.

5. Correlate Location Data: Where possible, correlate the extracted location data with external information sources like IP geolocation databases to ascertain more precise physical location details.

6. Document Findings: Keep detailed records of the cookies analyzed, the inferred locations, and any correlation with known user activities or events.

Forensic Importance

• Investigative Leads: Cookies can reveal locations that a user may have interacted with, providing leads for further investigation.

• Corroboration of Evidence: Location data from cookies can corroborate other digital evidence, supporting hypotheses about a user's whereabouts or actions.

• Timeline Construction: Timestamps associated with cookies can help construct a timeline of a user's online activities, including when specific locations were accessed.

Considerations

• Privacy and Legal Restrictions: Ensure adherence to privacy laws and guidelines when accessing and analyzing cookies, particularly those containing personal or sensitive information.

• Browser Configuration and Cleaning Tools: Be aware that browser settings, privacy modes, or the use of cleaning tools may affect the availability and longevity of cookies on a system.