Wednesday, July 18, 2012
Most of my initial research into the refresh and reset functions is complete. It took a while, as I've been managing many other projects at work, but within the next couple days expect to see a few blog posts up on here and on the LCDI blog in regards to my work.
On a side note, I was recently in contact with Jimmy Weg, author of http://justaskweg.com, in regards to some of my prior Windows 8 research. He kindly pointed out that Windows 8 is storing MSIE history within ESE databases and recommended parsing them with Mark Woan's EseDbViewer. As such, I popped my WebCachev24.dat file into the program, and it shot out a great amount of results to me.
It's great to have a lot of progress on the WebCachev24.dat files, personally. I had been trying to parse them at the hex level for a VERY long time. What a relief. Expect a blog post on this soon too, lots of testing to be set up.
Now, though, I am once again stumped with something else. Located within the user directory, <user>\appdata\local\microsoft\internet explorer\Indexed DB, is a file named NoQuota.edb. Within this file, from a purely hex view, some internet history related items can be found, mostly (without having thoroughly tested yet) seeming related to metro browsing. When attempting to open this with EseDbViewer, however, I get the error it needs repaired. So, I open up command line, run esentutl /r on it, and get an API parameter error. I thought it was maybe a windows 7 vs windows 8 issue, and attempted to do it on both a Windows 8 VM as well as the native machine the EDB file came from, but continually got API parameter errors. At this point, I'm stumped.
The error reads:
Initiating RECOVERY mode...
Logfile base name: c:\users\efleisher\desktop\noquota.edb
Log files: <current directory>
System files: <current directory>
Operation terminated with error -1003 (JET_errInvalidParameter, Invalid API parameter) after 0.0 seconds.