Tuesday, January 1, 2013

Backtrack Forensics: mork.pl

Forensics -> Forensic Analysis Tools

This is a program that can read the Mork file format, which was used by Mozilla for URL history files, which is named "history.dat", and by Thunderbird for contacts. Unfortunately  Firefox doesn't use this file for about 5 years now, as stated here: http://kb.mozillazine.org/History.dat. The location of this file was under:

C:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\<random text>\history.dat

Vista/Windows 7:
C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<random text>\history.dat

I haven't installed any old Firefox to try it, nor was able to get a sample file to test the application, but here is its help:

usage: mork.pl [--verbose] [--html] [--age secs] mork-input-file
'age' can be of the form '2h', '3d', etc.

Mork file format: http://en.wikipedia.org/wiki/Mork_(file_format)

Tool's website: http://code.google.com/p/linuxsleuthing/source/browse/nautilus-scripts/.support_scripts/mork.pl

No comments: