ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "Libmsiecf"

From ForensicsWiki
Jump to: navigation, search
(12 intermediate revisions by the same user not shown)
Line 5: Line 5:
 
   genre = {{Analysis}} |
 
   genre = {{Analysis}} |
 
   license = {{LGPL}} |
 
   license = {{LGPL}} |
   website = [http://libmsiecf.sourceforge.net libmsiecf.sourceforge.net] |
+
   website = [http://code.google.com/p/libmsiecf/ code.google.com/p/libmsiecf/] |
 
}}
 
}}
  
'''libmsiecf''' is a library currently under development to read the [[Internet Explorer History File Format | MSIE Cache File]] format. Intended for [[Linux]] systems, the library should also work on other platforms. The library is being developed by [[Joachim Metz]] of [[Hoffmann Investigations]].
+
The '''libmsiecf''' package contains a library and applications to read the [[Internet Explorer History File Format | MSIE Cache File]] format.
  
== External Links ==
+
== Tools ==  
 +
The libmsiecf package contains the following tools:
 +
* '''msiecfexport''', which exports the items stored in MSIECF files.
 +
* '''msiecfinfo''', which shows the information about MSIECF files.
  
* [http://libmsiecf.sourceforge.net/ Official web site]
+
== Examples ==
  
[[Category:Vaporware]]
+
Exporting items from an index.dat:
 +
<pre>
 +
msiecfexport -m items index.dat
 +
</pre>
 +
 
 +
Exporting recovered items from an index.dat:
 +
<pre>
 +
msiecfexport -m recovered index.dat
 +
</pre>
 +
 
 +
Exporting an index.dat from a Chinese Windows installation:
 +
<pre>
 +
msiecfexport -c windows-936 index.dat
 +
</pre>
 +
 
 +
== History ==
 +
Libmsiecf was created by [[Joachim Metz]] in 2009, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
 +
 
 +
Libmsiecf is a rewrite of [http://sourceforge.net/projects/odessa/ pasco] with support for more recent versions of [[Internet Explorer History File Format | MSIE Cache Files]]
 +
 
 +
== See Also ==
 +
* [[Internet Explorer History File Format | MSIE Cache Files]]
 +
 
 +
== External Links ==
 +
* [http://code.google.com/p/libmsiecf/ Project site]
 +
* [http://libmsiecf.sourceforge.net/ Old project site]

Revision as of 07:33, 26 August 2012

libmsiecf
Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Analysis
License: LGPL
Website: code.google.com/p/libmsiecf/

The libmsiecf package contains a library and applications to read the MSIE Cache File format.

Tools

The libmsiecf package contains the following tools:

  • msiecfexport, which exports the items stored in MSIECF files.
  • msiecfinfo, which shows the information about MSIECF files.

Examples

Exporting items from an index.dat:

msiecfexport -m items index.dat

Exporting recovered items from an index.dat:

msiecfexport -m recovered index.dat

Exporting an index.dat from a Chinese Windows installation:

msiecfexport -c windows-936 index.dat

History

Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.

Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files

See Also

External Links