[thrombox]

Unfortunately for me an important website I am no longer able to find was deleted from my history in firefox. I have taken steps to do a forensic recovery which basically involces creating a disk image and then running the Firefox History recoverer, however I'm finding it somewhat difficult.

I have downloaded Firefox History Recover from:

http://sourceforge.net/projects/ff3hr/

I have also acquired Winhex to create the disk image.

I am using the following as guides

http://www.opensourceresources.org/node/3435
http://www.blogsdna.com/4252/recover...ry-recover.htm

Basically the trouble now is I'm at a total loss over what to do? Into what format do I make Winhex image my hard drive? How do I then apply this to ff3hr?

Any help would be very much appreciated. Thanks

[Paladinz]

thrombox you need to create an uncompressed disk image in Winhex, dont forget NOT to store it on the drive you are attempting to recover the data from.

to use ff3hr click on Start and type cmd into the search box, and click on CMD.EXE at the top of the list, move to the folder ff3hr is located and type (without the <>)
ff3hr -i <image file name>

[thrombox]

Hi,

Ok I've managed to do it and run it only trouble is that it crashes eventually?

Is there a way around this?

Thanks

[Paladinz]

at what point does it crash?

[thrombox]

Well I create a whole disk image of my c: drive which is about 30gb, I've done it 3 times and each time the ff3hr crashes at a different point, once at 1400mb then at 3400mb.

I've now made the image into segments of 1.5gb hopefully it won't crash doing the segments.

[Paladinz]

fingers crossed it works, is there any error mesage?

[thrombox]

Bad news I'm afraid:

I imaged the hard drive into 21 segments here are the results so far of the forensic scan:

D:\Winhex\Drive C.001 Read 1120mb --- Recovered 0 records *Crashed*
D:\Winhex\Drive C.002 Read 150mb --- Recovered 0 records *Crashed*
D:\Winhex\Drive C.003 Read 1572mb --- Recovered 0 records
D:\Winhex\Drive C.004 Read 1572mb --- Recovered 0 records
D:\Winhex\Drive C.005 Read 1005mb --- Recovered 0 records *Crashed*

They have been tested twice and all crash at the exact same point. I will continue the other segments in hope.

Can you tell me what I'm doing wrong? Perhaps it is the image I'm creating, I have not compressed it? Please note when I made a whole image of my disc the 2nd time around I had 1008 record entries before it crashed, I'm afraid it never got to the actual web addresses however.

Is it my version of firefox that is the problem? I'm using the latest 3.6.8 I believe. Do you know of anyway to recover the history have been searching for the site for 2 days now!

Worst comes to the worst will I have to segment the disk into 100mb bits? That would be a nightmare to filter!

Appreciate the help, thanks.

[Paladinz]

Winhex uses uncompressed images so it is not that they have not been compressed.

Unfortunately I have not used Winhex myself so can not help you regarding the crashes. You might try asking at the X-Ways Support Forum regarding the crashes or use a different recovery program to locate and recover history.dat in your profile.

Maybe someone else here can help you further?

[thrombox]

Perhaps it is the imaging process? There is an option for compute hash with checksum, ripe and other options in it? Should I choose one of these methods?

Do you know of a better more user friendly program that can make an image of my c drive?

Out of interest why should I not change the image of a drive in the same drive? (if at all possible).

It could actually be a badly written program as well perhaps ff3hr is the problem.

Thanks

[Paladinz]

The information you are trying to rcover is not erased but marked as free space on the drive. This is overwritten when you write any information to the drive. So the basic rule of data recovery is not to write anything to the drive you are trying to recover data from as you may well be overwritting the data you wish to recover.

You might try http://www.easeus.com/datarecoverywi...y-software.htm and try to recover the history.dat file.

[helpful]

firefox uses places.sqlite to store browser history. Inside the database moz_historyvisits and moz_places tables store the history along with other data.

The firefox browser would not have deleted the entire database, just the history records would be deleted from the two tables... Good luck!

(20) I accidentally deleted some important information from my SQLite database. How can I recover it?

If you have a backup copy of your database file, recover the information from your backup. If you do not have a backup, recovery is very difficult. You might be able to find partial string data in a binary dump of the raw database file. Recovering numeric data might also be possible given special tools, though to our knowledge no such tools exist. SQLite is sometimes compiled with the SQLITE_SECURE_DELETE option which overwrites all deleted content with zeros. If that is the case then recovery is clearly impossible. Recovery is also impossible if you have run VACUUM since the data was deleted. If SQLITE_SECURE_DELETE is not used and VACUUM has not been run, then some of the deleted content might still be in the database file, in areas marked for reuse. But, again, there exist no procedures or tools that we know of to help you recover that data.

http://www.sqlite.org/faq.html#q20

[lotuseclat79]

What I do on a daily basis, sometimes 3-4 times (in fact, every session I make a new bookmark or filter my Firefox history to keep some links, but at least once a day) - I save my Firefox profile on my hard drive, the location of which is different from where Firefox is installed on the hard drive.

It is your Firefox profile that stores all of your iimportant data - bookmarks, history, cookies, extensions and passwords.

Backing up your information.

-- Tom

[thrombox]

Originally Posted by lotuseclat79

What I do on a daily basis, sometimes 3-4 times (in fact, every session I make a new bookmark or filter my Firefox history to keep some links, but at least once a day) - I save my Firefox profile on my hard drive, the location of which is different from where Firefox is installed on the hard drive.

It is your Firefox profile that stores all of your iimportant data - bookmarks, history, cookies, extensions and passwords.

Backing up your information.

-- Tom

I fail to see how his helps me at the moment? I know people have recovered their deleted histories, just can't seem to understand why the program keeps crashing? It does discover some hidden things but then just dies?

[lotuseclat79]

Hi thrombox,

It was intended to help you in the future - obviously! Given the current situation as you describe it, without backup of at least a Firefox profile (perhaps something you probably never thought to investigate or learn more about - I'm guessing), it looks to me like your Firefox history is toast, except I never heard about ff3hr tool before.

So, indeed - why is ff3hr tool crashing? I would run ff3hr tool via a symbolic debugger to find out where it is crashing. I recommend the Win Sysinternal Tools website - do have a look as there might be a tool or debugging technique in Mark's blog that would help you to solve the problem. How much memory do you have, which Windows OS?

-- Tom

[thrombox]

except I never heard about ff3hr tool before.

Well then why are you trying to advise me? I don't need to be preached about what I should have done or what I need in the future I need a solution for now, so if you really can't help then I really don't need your righteousness thank you.

There is a tool that works its called ff3hr it recovers your deleted history I know that it works for other people, I'm doing something wrong and it doesn't seem to be running correctly, I think the trouble could be with the image Winhex is creating. This is the solution I need and not useles information with an attitude such as profile firefox in the "future" or that I need to run a debugger to find out "where" it crashes? How will that help at all?

There is only one solution, what exactly am I doing wrong when I image the C: drive that makes ff3hr1.2 unstable and crash, while only detecting some old files? I ran ff3hr1.11 with no trouble however it could not detect even the current undeleted history or anything for that matter.