Firefox browser NOT supported?

[goced]

Browser History entries in Recent Activity does not contain records from Firefox. I am sure that they exist because they are saved in user profile in file places.sqlite and I can see them by SQLite viewer.

[David (PassMark)]

We do support Firefox.
What version of Firefox is this and which O/S?

Can you collect a debug log and E-Mail it to us. Thanks.

[goced]

We do support Firefox.
What version of Firefox is this and which O/S?

Can you collect a debug log and E-Mail it to us. Thanks.

Firefox 3.6.3 on WinXPSP3 (on image file)

OSForensics 1.1 build 1002 64-bit on Win7 x64


After running in debug mode, from log file I extracted this portion regarding Firefox:

28.502s - Recent Activity Scan: Get Firefox info start
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.502s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Extract $MFT attributes
28.517s - Recent Activity Scan: Get Firefox info finish

As you can notice there is no records of locating and processing users profiles and files for collecting history of URLs, cookies, etc, as it is the case for other browsers.

[David (PassMark)]

You are using an older OSF release.
Can you try either,

V1.2 build 1003
http://www.osforensics.com/download.html

Or
V2.0 Alpha
http://www.passmark.com/forum/showth...a-Beta-release

And let me know if you still have the same problem.

[goced]

Same issue with both newer versions.

I tried with different images with WinXP, got same issue.
But with Win7 is OK.
Probably problem with profiles paths.
XP stores users in \Documents and Settings, while Win7 in \Users

[David (PassMark)]

OK thanks, we'll see if we can reproduce it and fix it next week.

[Tim (PassMark)]

We were able to reproduce when directly accessing the image (after adding it to a case) so it will be fixed in the next V2 alpha/beta release. In the meantime you should be able to work around this by mounting the image to a drive letter and then running the scan.