I know I'm late to the discussion a bit, but I've always been partial to this tool for history recovery of both IE and Firefox: http://www.codeproject.com/KB/vbscript/Internet_Explorer_Spy.aspx
Does a better job than the commercial tools and it's free! -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David A. Gershman Sent: Tuesday, November 10, 2009 9:18 PM To: PaulDotCom Security Weekly Mailing List Subject: Re: [Pauldotcom] A question about browser history > > anyone knows of a way this could have happened which backs up the employee's > > story or do I just go ahead and assume guilt? First (IMHO) Don't assume guilt or innocence. Stick to what you were asked...find evidence if its there. If its not there, fine. Start assuming anything or taking the employee's "nature" into account and you're doing the manager's/company's job. If this employee gets fired for an 'assumption', you'll feel it. Provide the best evidence you can and let the verdict reside with the company. I know it sounds cold, but when doing forensics its important to remain as objective as possible. Second As for how their history could have been populated, I really have no idea. I do know this, don't just look within the browser. A good piece of malware coming from a thumbdrive could screw with browser files just as easily. Be sure to scour the big picture. ---------------------------------------- David A. Gershman [email protected] http://dagertech.net/gershman/ "It's all about the path!" --d. gershman _______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com ****************************************************************************** This email contains confidential and proprietary information and is not to be used or disclosed to anyone other than the named recipient of this email, and is to be used only for the intended purpose of this communication. ****************************************************************************** _______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
