CONTENTS

Forensics: Viewing IE Cache

Viewing Microsoft Internet Explorer Cache.  The objective of this exercise is to show how the encrypted Internet Explorer cache may be viewed using some freely available tools.  Pasco and Galleta are to DOS-based executables that can decrypt the Internet Explorer cache. The use of these tools are demonstrated in this exercise.

1.  Login to a Windows machine in the lab.

a.  Username: Administrator

b.  Password: (no password)

2.  Double click the “Internet Explo…” link on the desktop to open a windows terminal.

3.  From the parent folder, open the Internet Explorer cache called “index.dat” using a text editor.

a.  At the prompt, enter: notepad data\index.dat

b.  What is the content like?

c.  Close notepad window.

4.  Use pasco to decrypt the Internet explorer cache called “index.dat”

a.  At the prompt, enter: pasco\pasco data\index.dat > index.txt

b.  At the prompt, enter: notepad index.txt

c.  What is the content like?

d.  Close notepad window.

5.  Use galleta to decrypt cookies.

a.  At the prompt, enter: galleta.exe data\bassel@advertising[2].txt

b.  What is the result?

6.  How can Pasco and Galleta be useful?