Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

All Other Software All Other Software
Search Search
Search for:
Tech Support Guy > > >

Recovering deleted firefox history.


(!)

thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
30-Aug-2010, 11:00 AM #1
Recovering deleted firefox history.
Unfortunately for me an important website I am no longer able to find was deleted from my history in firefox. I have taken steps to do a forensic recovery which basically involces creating a disk image and then running the Firefox History recoverer, however I'm finding it somewhat difficult.

I have downloaded Firefox History Recover from:

http://sourceforge.net/projects/ff3hr/

I have also acquired Winhex to create the disk image.

I am using the following as guides

http://www.opensourceresources.org/node/3435
http://www.blogsdna.com/4252/recover...ry-recover.htm

Basically the trouble now is I'm at a total loss over what to do? Into what format do I make Winhex image my hard drive? How do I then apply this to ff3hr?

Any help would be very much appreciated. Thanks

Last edited by thrombox; 30-Aug-2010 at 11:51 AM..
Paladinz's Avatar
Paladinz Paladinz is offline
Member with 157 posts.
 
Join Date: Aug 2010
Experience: Advanced
30-Aug-2010, 04:21 PM #2
thrombox you need to create an uncompressed disk image in Winhex, dont forget NOT to store it on the drive you are attempting to recover the data from.

to use ff3hr click on Start and type cmd into the search box, and click on CMD.EXE at the top of the list, move to the folder ff3hr is located and type (without the <>)
ff3hr -i <image file name>
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
30-Aug-2010, 05:21 PM #3
Hi,

Ok I've managed to do it and run it only trouble is that it crashes eventually?

Is there a way around this?

Thanks
Paladinz's Avatar
Paladinz Paladinz is offline
Member with 157 posts.
 
Join Date: Aug 2010
Experience: Advanced
30-Aug-2010, 05:29 PM #4
at what point does it crash?
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
31-Aug-2010, 02:31 AM #5
Well I create a whole disk image of my c: drive which is about 30gb, I've done it 3 times and each time the ff3hr crashes at a different point, once at 1400mb then at 3400mb.

I've now made the image into segments of 1.5gb hopefully it won't crash doing the segments.
Paladinz's Avatar
Paladinz Paladinz is offline
Member with 157 posts.
 
Join Date: Aug 2010
Experience: Advanced
31-Aug-2010, 03:08 AM #6
fingers crossed it works, is there any error mesage?
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
31-Aug-2010, 03:15 AM #7
Bad news I'm afraid:

I imaged the hard drive into 21 segments here are the results so far of the forensic scan:

D:\Winhex\Drive C.001 Read 1120mb --- Recovered 0 records *Crashed*
D:\Winhex\Drive C.002 Read 150mb --- Recovered 0 records *Crashed*
D:\Winhex\Drive C.003 Read 1572mb --- Recovered 0 records
D:\Winhex\Drive C.004 Read 1572mb --- Recovered 0 records
D:\Winhex\Drive C.005 Read 1005mb --- Recovered 0 records *Crashed*

They have been tested twice and all crash at the exact same point. I will continue the other segments in hope.

Can you tell me what I'm doing wrong? Perhaps it is the image I'm creating, I have not compressed it? Please note when I made a whole image of my disc the 2nd time around I had 1008 record entries before it crashed, I'm afraid it never got to the actual web addresses however.

Is it my version of firefox that is the problem? I'm using the latest 3.6.8 I believe. Do you know of anyway to recover the history have been searching for the site for 2 days now!

Worst comes to the worst will I have to segment the disk into 100mb bits? That would be a nightmare to filter!

Appreciate the help, thanks.

Last edited by thrombox; 31-Aug-2010 at 03:23 AM..
Paladinz's Avatar
Paladinz Paladinz is offline
Member with 157 posts.
 
Join Date: Aug 2010
Experience: Advanced
31-Aug-2010, 03:59 AM #8
Winhex uses uncompressed images so it is not that they have not been compressed.

Unfortunately I have not used Winhex myself so can not help you regarding the crashes. You might try asking at the X-Ways Support Forum regarding the crashes or use a different recovery program to locate and recover history.dat in your profile.

Maybe someone else here can help you further?
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
31-Aug-2010, 05:16 AM #9
Perhaps it is the imaging process? There is an option for compute hash with checksum, ripe and other options in it? Should I choose one of these methods?

Do you know of a better more user friendly program that can make an image of my c drive?

Out of interest why should I not change the image of a drive in the same drive? (if at all possible).

It could actually be a badly written program as well perhaps ff3hr is the problem.

Thanks

Last edited by thrombox; 31-Aug-2010 at 05:42 AM..
Paladinz's Avatar
Paladinz Paladinz is offline
Member with 157 posts.
 
Join Date: Aug 2010
Experience: Advanced
31-Aug-2010, 05:45 AM #10
The information you are trying to rcover is not erased but marked as free space on the drive. This is overwritten when you write any information to the drive. So the basic rule of data recovery is not to write anything to the drive you are trying to recover data from as you may well be overwritting the data you wish to recover.

You might try http://www.easeus.com/datarecoverywi...y-software.htm and try to recover the history.dat file.
helpful's Avatar
helpful helpful is offline
Computer Specs
Member with 697 posts.
 
Join Date: Sep 2009
Location: Canada
Experience: Advanced
31-Aug-2010, 05:54 AM #11
firefox uses places.sqlite to store browser history. Inside the database moz_historyvisits and moz_places tables store the history along with other data.

The firefox browser would not have deleted the entire database, just the history records would be deleted from the two tables... Good luck!

Quote:
(20) I accidentally deleted some important information from my SQLite database. How can I recover it?
If you have a backup copy of your database file, recover the information from your backup. If you do not have a backup, recovery is very difficult. You might be able to find partial string data in a binary dump of the raw database file. Recovering numeric data might also be possible given special tools, though to our knowledge no such tools exist. SQLite is sometimes compiled with the SQLITE_SECURE_DELETE option which overwrites all deleted content with zeros. If that is the case then recovery is clearly impossible. Recovery is also impossible if you have run VACUUM since the data was deleted. If SQLITE_SECURE_DELETE is not used and VACUUM has not been run, then some of the deleted content might still be in the database file, in areas marked for reuse. But, again, there exist no procedures or tools that we know of to help you recover that data.
http://www.sqlite.org/faq.html#q20
lotuseclat79's Avatar
Member with 20,583 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
31-Aug-2010, 07:29 AM #12
What I do on a daily basis, sometimes 3-4 times (in fact, every session I make a new bookmark or filter my Firefox history to keep some links, but at least once a day) - I save my Firefox profile on my hard drive, the location of which is different from where Firefox is installed on the hard drive.

It is your Firefox profile that stores all of your iimportant data - bookmarks, history, cookies, extensions and passwords.

Backing up your information.

-- Tom
__________________
The independence created by philosophical insight is - in my opinion - the mark of distinction
between a mere artisan or specialist and a real seeker after truth. - Einstein 1944
Imagination is more important than knowledge. - Einstein
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
31-Aug-2010, 10:04 AM #13
Quote:
Originally Posted by lotuseclat79 View Post
What I do on a daily basis, sometimes 3-4 times (in fact, every session I make a new bookmark or filter my Firefox history to keep some links, but at least once a day) - I save my Firefox profile on my hard drive, the location of which is different from where Firefox is installed on the hard drive.

It is your Firefox profile that stores all of your iimportant data - bookmarks, history, cookies, extensions and passwords.

Backing up your information.

-- Tom
I fail to see how his helps me at the moment? I know people have recovered their deleted histories, just can't seem to understand why the program keeps crashing? It does discover some hidden things but then just dies?
lotuseclat79's Avatar
Member with 20,583 posts.
 
Join Date: Sep 2003
Location: -71.45091, 42.27841
31-Aug-2010, 11:09 PM #14
Hi thrombox,

It was intended to help you in the future - obviously! Given the current situation as you describe it, without backup of at least a Firefox profile (perhaps something you probably never thought to investigate or learn more about - I'm guessing), it looks to me like your Firefox history is toast, except I never heard about ff3hr tool before.

So, indeed - why is ff3hr tool crashing? I would run ff3hr tool via a symbolic debugger to find out where it is crashing. I recommend the Win Sysinternal Tools website - do have a look as there might be a tool or debugging technique in Mark's blog that would help you to solve the problem. How much memory do you have, which Windows OS?

-- Tom
thrombox's Avatar
thrombox thrombox is offline
Member with 32 posts.
THREAD STARTER
 
Join Date: Jul 2010
Experience: Intermediate
01-Sep-2010, 02:31 AM #15
Quote:
except I never heard about ff3hr tool before.
Well then why are you trying to advise me? I don't need to be preached about what I should have done or what I need in the future I need a solution for now, so if you really can't help then I really don't need your righteousness thank you.

There is a tool that works its called ff3hr it recovers your deleted history I know that it works for other people, I'm doing something wrong and it doesn't seem to be running correctly, I think the trouble could be with the image Winhex is creating. This is the solution I need and not useles information with an attitude such as profile firefox in the "future" or that I need to run a debugger to find out "where" it crashes? How will that help at all?

There is only one solution, what exactly am I doing wrong when I image the C: drive that makes ff3hr1.2 unstable and crash, while only detecting some old files? I ran ff3hr1.11 with no trouble however it could not detect even the current undeleted history or anything for that matter.
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


Similar Threads
Title Thread Starter Forum Replies Last Post
Solved: Can't Delete Firefox Cookie compconfused Web & Email 16 05-Aug-2010 09:19 PM
How to recover deleted internet histories?? chaoscreater Windows 7 2 22-Jan-2010 12:35 AM
deleting firefox history bigdan Web & Email 11 28-Jun-2009 10:42 PM
Recover deleted IE history brini145 Web & Email 5 02-Jun-2009 12:18 AM
Recover deleted internet history ? tomwi11is Windows XP 0 03-Jul-2008 06:24 AM

WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑

Content Relevant URLs by vBSEO 3.3.2