On Tue, 7 Aug 2001, Manuel Beltran wrote: > The Netscape history file keeps track of places you have been, including > dates. I have found an entry in the history file that is very significant > to my case, but Netscape seems to have marked it as expired and I cannot get > the NS History viewer to display the entry. I can see it with strings, > gHex, BinText, etc, but I cannot get the date info I need this way since the > date field is in binary. As you can see, it is mostly text. You could probably figure out the date format by doing comparisons. You could probably also et the netscape history viewer to show it by rolling back the date on your machine. Also be careful, as netscape likes to erase expired entries. However, see below: > > Is there a viewer that anyone knows of that will let me review the entire > contents of the history file (netscape.hst - Win32, history.dat - Unix), in > its entirety? Seems to me that this would be a very common tool to have. > We have become spoiled by the lack of privacy in IE and ease with which this > info can be had, so I suspect that there are not too many tools out there > for NS. An EnCase escript would be nice :) I don't have EnCase to help you, but there are some perl modules that are directly relevent: http://www.perldoc.com/cpan/Netscape/Cache.html http://www.perldoc.com/cpan/Netscape/History.html Ryan ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Aug 09 2001 - 15:15:18 PDT