1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Recovering deleted firefox history.

Discussion in 'All Other Software' started by thrombox, Aug 30, 2010.

Thread Status:
Not open for further replies.
Advertisement
  1. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Unfortunately for me an important website I am no longer able to find was deleted from my history in firefox. I have taken steps to do a forensic recovery which basically involces creating a disk image and then running the Firefox History recoverer, however I'm finding it somewhat difficult.

    I have downloaded Firefox History Recover from:

    http://sourceforge.net/projects/ff3hr/

    I have also acquired Winhex to create the disk image.

    I am using the following as guides

    http://www.opensourceresources.org/node/3435
    http://www.blogsdna.com/4252/recover-deleted-firefox-35-history-with-firefox-history-recover.htm

    Basically the trouble now is I'm at a total loss over what to do? Into what format do I make Winhex image my hard drive? How do I then apply this to ff3hr?

    Any help would be very much appreciated. Thanks
     
  2. Paladinz

    Paladinz

    Joined:
    Aug 23, 2010
    Messages:
    157
    thrombox you need to create an uncompressed disk image in Winhex, dont forget NOT to store it on the drive you are attempting to recover the data from.

    to use ff3hr click on Start and type cmd into the search box, and click on CMD.EXE at the top of the list, move to the folder ff3hr is located and type (without the <>)
    ff3hr -i <image file name>
     
  3. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Hi,

    Ok I've managed to do it and run it only trouble is that it crashes eventually?

    Is there a way around this?

    Thanks
     
  4. Paladinz

    Paladinz

    Joined:
    Aug 23, 2010
    Messages:
    157
    at what point does it crash?
     
  5. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Well I create a whole disk image of my c: drive which is about 30gb, I've done it 3 times and each time the ff3hr crashes at a different point, once at 1400mb then at 3400mb.

    I've now made the image into segments of 1.5gb hopefully it won't crash doing the segments.
     
  6. Paladinz

    Paladinz

    Joined:
    Aug 23, 2010
    Messages:
    157
    fingers crossed it works, is there any error mesage?
     
  7. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Bad news I'm afraid:

    I imaged the hard drive into 21 segments here are the results so far of the forensic scan:

    D:\Winhex\Drive C.001 Read 1120mb --- Recovered 0 records *Crashed*
    D:\Winhex\Drive C.002 Read 150mb --- Recovered 0 records *Crashed*
    D:\Winhex\Drive C.003 Read 1572mb --- Recovered 0 records
    D:\Winhex\Drive C.004 Read 1572mb --- Recovered 0 records
    D:\Winhex\Drive C.005 Read 1005mb --- Recovered 0 records *Crashed*

    They have been tested twice and all crash at the exact same point. I will continue the other segments in hope.

    Can you tell me what I'm doing wrong? Perhaps it is the image I'm creating, I have not compressed it? Please note when I made a whole image of my disc the 2nd time around I had 1008 record entries before it crashed, I'm afraid it never got to the actual web addresses however.

    Is it my version of firefox that is the problem? I'm using the latest 3.6.8 I believe. Do you know of anyway to recover the history have been searching for the site for 2 days now!

    Worst comes to the worst will I have to segment the disk into 100mb bits? That would be a nightmare to filter!

    Appreciate the help, thanks.
     
  8. Paladinz

    Paladinz

    Joined:
    Aug 23, 2010
    Messages:
    157
    Winhex uses uncompressed images so it is not that they have not been compressed.

    Unfortunately I have not used Winhex myself so can not help you regarding the crashes. You might try asking at the X-Ways Support Forum regarding the crashes or use a different recovery program to locate and recover history.dat in your profile.

    Maybe someone else here can help you further?
     
  9. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Perhaps it is the imaging process? There is an option for compute hash with checksum, ripe and other options in it? Should I choose one of these methods?

    Do you know of a better more user friendly program that can make an image of my c drive?

    Out of interest why should I not change the image of a drive in the same drive? (if at all possible).

    It could actually be a badly written program as well perhaps ff3hr is the problem.

    Thanks
     
  10. Paladinz

    Paladinz

    Joined:
    Aug 23, 2010
    Messages:
    157
    The information you are trying to rcover is not erased but marked as free space on the drive. This is overwritten when you write any information to the drive. So the basic rule of data recovery is not to write anything to the drive you are trying to recover data from as you may well be overwritting the data you wish to recover.

    You might try http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm and try to recover the history.dat file.
     
  11. helpful

    helpful

    Joined:
    Sep 17, 2009
    Messages:
    697
    firefox uses places.sqlite to store browser history. Inside the database moz_historyvisits and moz_places tables store the history along with other data.

    The firefox browser would not have deleted the entire database, just the history records would be deleted from the two tables... Good luck!

    http://www.sqlite.org/faq.html#q20
     
  12. lotuseclat79

    lotuseclat79

    Joined:
    Sep 12, 2003
    Messages:
    20,583
    What I do on a daily basis, sometimes 3-4 times (in fact, every session I make a new bookmark or filter my Firefox history to keep some links, but at least once a day) - I save my Firefox profile on my hard drive, the location of which is different from where Firefox is installed on the hard drive.

    It is your Firefox profile that stores all of your iimportant data - bookmarks, history, cookies, extensions and passwords.

    Backing up your information.

    -- Tom
     
  13. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    I fail to see how his helps me at the moment? I know people have recovered their deleted histories, just can't seem to understand why the program keeps crashing? It does discover some hidden things but then just dies?
     
  14. lotuseclat79

    lotuseclat79

    Joined:
    Sep 12, 2003
    Messages:
    20,583
    Hi thrombox,

    It was intended to help you in the future - obviously! Given the current situation as you describe it, without backup of at least a Firefox profile (perhaps something you probably never thought to investigate or learn more about - I'm guessing), it looks to me like your Firefox history is toast, except I never heard about ff3hr tool before.

    So, indeed - why is ff3hr tool crashing? I would run ff3hr tool via a symbolic debugger to find out where it is crashing. I recommend the Win Sysinternal Tools website - do have a look as there might be a tool or debugging technique in Mark's blog that would help you to solve the problem. How much memory do you have, which Windows OS?

    -- Tom
     
  15. thrombox

    thrombox Thread Starter

    Joined:
    Jul 29, 2010
    Messages:
    32
    Well then why are you trying to advise me? I don't need to be preached about what I should have done or what I need in the future I need a solution for now, so if you really can't help then I really don't need your righteousness thank you.

    There is a tool that works its called ff3hr it recovers your deleted history I know that it works for other people, I'm doing something wrong and it doesn't seem to be running correctly, I think the trouble could be with the image Winhex is creating. This is the solution I need and not useles information with an attitude such as profile firefox in the "future" or that I need to run a debugger to find out "where" it crashes? How will that help at all?

    There is only one solution, what exactly am I doing wrong when I image the C: drive that makes ff3hr1.2 unstable and crash, while only detecting some old files? I ran ff3hr1.11 with no trouble however it could not detect even the current undeleted history or anything for that matter.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/946729