Difference between pages "Apple Safari" and "Talk:Linux Logical Volume Manager (LVM)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Locations)
 
(Created page with "Should we change :To make the volume group known to the system :vgexport $VOLUMEGROUP to :To make the volume group known to the system :vgimport $VOLUMEGROUP ? vgexport ma...")
 
Line 1: Line 1:
{{Expand}}
+
Should we change
Apple Safari is the default [[Web Browser|web browser]] included with [[Mac OS X]].
+
  
== Locations ==
+
:To make the volume group known to the system
The Safari browser uses different locations to store different kind of information.
+
:vgexport $VOLUMEGROUP
  
The user directory:
+
to
  
On MacOS-X
+
:To make the volume group known to the system
<pre>
+
:vgimport $VOLUMEGROUP
/Users/$USER/Library/Safari/
+
?
</pre>
+
  
On Windows XP
+
vgexport makes volume groups ''unknown'' to the system, vgimport makes exported volumes ''known'' to the system. See also [http://www.tldp.org/HOWTO/LVM-HOWTO/recipemovevgtonewsys.html this]. You should also remember, that both vgexport/vgimport alter the data on the physical device. I also added "loop" option to the mount command example, since "-o ro" may alter the data in the file system (replay the journal, etc) [[User:.FUF|.FUF]] ([[User talk:.FUF|talk]]) 10:19, 7 May 2014 (CDT)
<pre>
+
C:\Documents and Settings\%USERNAME%\Application Data\Apple Computer\Safari\
+
</pre>
+
 
+
On Windows 7
+
<pre>
+
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\
+
</pre>
+
 
+
The cache directory:
+
 
+
On MacOS-X
+
<pre>
+
/Users/$USER/Library/Caches/com.apple.Safari/
+
</pre>
+
 
+
On Windows XP
+
<pre>
+
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Apple Computer\Safari\
+
</pre>
+
 
+
On Windows 7
+
<pre>
+
C:\Users\{user}\AppData\Local\Apple Computer\Safari\
+
</pre>
+
 
+
== History ==
+
The browser history is stored in a [[Property list | binary plist file]] named '''History.plist''' in the user directory.
+
 
+
This file can be viewed directly in [[Mac OS X]] by opening file in the [[Property List Editor]] program.
+
 
+
For each web site, the program records the URL visited, the date and time of the last visit, and the number of times the site has been visited.
+
 
+
The date and time values are stored as a floating point value containing the number of seconds since Jan 1, 2001 00:00:00 UTC.
+
 
+
On a Windows PC History.plist file can be opened in [[Oxygen Forensic Plist Viewer]] software.
+
 
+
The downloads history can also be found in the user directory in a binary plist file named '''Downloads.plist'''.
+
 
+
== Cache ==
+
The Safari cache is stored in '''Cache.db''' in the cache directory.
+
 
+
This file uses the [[SQLite database format]].
+
 
+
== External Links ==
+
 
+
* [http://www.apple.com/macosx/features/safari/ Official website]
+
* [http://www.appleexaminer.com/files/Safari_Cache.db_Revisited.pdf Safari Cache Revisited] by Sean Cavanaugh
+
* [http://jafat.sourceforge.net/ J.A.F.A.T. Archive of Forensics Analysis Tools] home of Safari Forensic Tools (SFT)
+
 
+
[[Category:Applications]]
+
[[Category:Web Browsers]]
+
[[Category:Mac OS X]]
+

Latest revision as of 11:19, 7 May 2014

Should we change

To make the volume group known to the system
vgexport $VOLUMEGROUP

to

To make the volume group known to the system
vgimport $VOLUMEGROUP

?

vgexport makes volume groups unknown to the system, vgimport makes exported volumes known to the system. See also this. You should also remember, that both vgexport/vgimport alter the data on the physical device. I also added "loop" option to the mount command example, since "-o ro" may alter the data in the file system (replay the journal, etc) .FUF (talk) 10:19, 7 May 2014 (CDT)