Difference between revisions of "Libmsiecf"

From ForensicsWiki
Jump to: navigation, search
m
(13 intermediate revisions by 2 users not shown)
Line 5: Line 5:
 
   genre = {{Analysis}} |
 
   genre = {{Analysis}} |
 
   license = {{LGPL}} |
 
   license = {{LGPL}} |
   website = [http://libmsiecf.sourceforge.net libmsiecf.sourceforge.net] |
+
   website = [http://code.google.com/p/libmsiecf/ code.google.com/p/libmsiecf/] |
 
}}
 
}}
  
The '''libmsiecf''' package contains [[Linux]] based library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
+
The '''libmsiecf''' package contains a library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
  
It has been ported to other platforms like [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]] and [[Windows]] as well.
+
== Tools ==
 +
The libmsiecf package contains the following tools:
 +
* '''msiecfexport''', which exports the items stored in MSIECF files.
 +
* '''msiecfinfo''', which shows the information about MSIECF files.  
  
== History ==  
+
== Examples ==  
  
 +
Exporting items from an index.dat:
 +
<pre>
 +
msiecfexport -m items index.dat
 +
</pre>
 +
 +
Exporting recovered items from an index.dat:
 +
<pre>
 +
msiecfexport -m recovered index.dat
 +
</pre>
 +
 +
Exporting an index.dat from a Chinese Windows installation:
 +
<pre>
 +
msiecfexport -c windows-936 index.dat
 +
</pre>
 +
 +
== History ==
 
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
 
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
  
== Tools ==
+
Libmsiecf is a rewrite of [http://sourceforge.net/projects/odessa/ pasco] with support for more recent versions of [[Internet Explorer History File Format | MSIE Cache Files]]
No files released yet.
+
  
== External Links ==
+
== See Also ==
 +
* [[Internet Explorer History File Format | MSIE Cache Files]]
  
* [http://libmsiecf.sourceforge.net libmsiecf project site]
+
== External Links ==
 +
* [http://code.google.com/p/libmsiecf/ Project site]
 +
* [http://libmsiecf.sourceforge.net/ Old project site]

Revision as of 02:33, 26 August 2012

libmsiecf
Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Analysis
License: LGPL
Website: code.google.com/p/libmsiecf/

The libmsiecf package contains a library and applications to read the MSIE Cache File format.

Tools

The libmsiecf package contains the following tools:

  • msiecfexport, which exports the items stored in MSIECF files.
  • msiecfinfo, which shows the information about MSIECF files.

Examples

Exporting items from an index.dat:

msiecfexport -m items index.dat

Exporting recovered items from an index.dat:

msiecfexport -m recovered index.dat

Exporting an index.dat from a Chinese Windows installation:

msiecfexport -c windows-936 index.dat

History

Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.

Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files

See Also

External Links