Practical Mobile Forensics - Fourth Edition

Extracting internet history

Internet history can be extracted from the WebCacheV01.dat file located at \Users\DefApps\APPDATA\Local\Microsoft\Windows\WebCache\. Here is an example of a Windows 10 WebCacheV01.dat file:

The WebCacheV01.dat file in a Windows Phone

These files can be examined manually, for example, with a hex viewer, or can be parsed automatically with mobile forensic tools. Here is the WebCacheV01.dat file being parsed with Magnet AXIOM:

WebCacheV01.dat file parsed with Magnet AXIOM

With this, we've covered how to extract SMS, ...