News.com has an article on how “the advent of Firefox and other alternatives to Internet Explorer means cybercops have to learn new tricks for their investigations“:
Internet Explorer hides nothing from police and other investigators who examine PCs to discover which sites the user has visited, according to a class held Wedensday at the annual training meeting of the High Tech Crime Investigation Association. Investigators know the location of the IE browser cache, cookie files and history, and they know how to read those files. Also, popular forensics tools can help out.
But that story changes when it comes to alternative Web browsers such as Firefox and Opera, instructor Glenn Lewis said at the well-attended session. These programs use different structures, files and naming conventions for the data that investigators are after. And files are in a different location on the hard drive, which can cause trouble for examiners. Furthermore, forensics software may not support the Web browsers, he said.
Though Microsoft’s IE remains the most widely used browser, these alternatives are gaining in popularity. The open-source Firefox browser in particular has been able to nibble at Microsoft’s dominant share of the market. Web browser data can be important in criminal investigations because browsers keep track of a suspect’s online activity.
This brings up the question of what qualifications these “computer forensics experts” have, if any. Especially if they can’t figure out basic shit like this for themselves (Tip, there’s this cool site called Google where you can search for all sort of swell stuff). There are plenty of tools for reading someones firefox/opera cache and seing where he/she has been. So these people are either lying through their teeth or dumb as my left shoe. You decide….
I am one of those “Computer Forensic Experts” and you are correct, at least some of the time. There are examiners who rely on their tools solely to keep them up-to-date with technology rather than vice versa. However, consider the enormous breadth of technological change and the pace at which it occurs and you may be able to empathize with that occurence.
Remember, computer forensic experts are of varying levels of skill, drive and intellect — just as you will find in any field, private or public sector.
Regards.
While I agree with you that technology changes a lot, if you’re stupid enough not to know how firefox works or how to use Google you should not call yourself a computer forensic experts.
This is stuff even a 12 year old can find out.
Photo Caption: “Is anyone looking at us, Fred?” “No, Jed. It’s clear behind ya. Take it to the computer lab, and we can have a LAN party.”
Hehe…
Nice caption