Since HTTP is a stateless protocol, websites must place information on a user’s computer if it needs to save information about a web session. For instance, when a user selects a widget and adds it to his shopping cart, that information can be saved on the client computer rather than the web server. The facility to save information in this manner is known as Cookies. A cookie is a small file containing data that the web server places on a user’s computer so it may request back at a later date.

During forensic analysis it is often relevant to parse the information in Internet Explorer’s cookie files into a human readable format. Cookies aid forensic analysts during the investigation by providing insight to a suspect’s internet activity. After analysis of several example cookie files it was found that the format is relatively simple to understand. This paper will document the format of Internet Explorer’s (IE) cookie files for forensic analysis purposes and provide an open source tool to parse the information into a human readable format.

Download pdf Forensic Analysis of Microsoft Internet Explorer Cookie Files