FIRST Forensic Internet Replay Sequencing Tool

This paper discusses the design and development of a tool that can be used by digital forensic investigators to display a visual recreation of Web browsing sessions based on the browser cache stored on a suspectpsilas hard drive. Frequently, a forensic investigator will search a Web browser cache to learn about the browsing habits of a suspect. The data gathered from the cache will be used to support a case in a civil or criminal proceeding. Thus, the investigator must have a method to clearly convey the information learned from the investigation of the cache. Currently, tools exist that can parse the browser cache to determine the Uniform Resource Locaters (URLs) visited by the suspect and the times that the URLs were visited. While this data indicates the browsing habits of the suspect, a list of URLs and timestamps is not easily understood by non-information technology professionals. The goal is to construct a tool that will assemble a visual slideshow that recreates, as closely as possible, a suspectpsilas browsing experience. This recreation will help provide investigators and other interested parties with an accurate understanding of the suspectpsilas intentions while browsing the Web.