Re: IE persistent cookie file format

["Jim Halfpenny" <jim () openanswers co uk>]

> Would someone on the list define each line within the
> IE cookie file format for me? Clearly the first 3 and
> the last line are obvious, the rest I'm not 100% sure
> of.
>
>
> IE cookie format example:
>
> SESSIONID
> 029380ifj0q348rjf140f843q08fj134
> hostname.com/path/
> 1024
> 750792448
> 31975012
> 4270545888
> 29772247
> *

Hi,
According to the excelent book, "Real Digial Forensics," (ISBN
0321240693), the fields go something like this..

1. Cookie name
2. Cookie value
3. Host/path for the web server setting the cookie
4. Flags
5. Exirpation time
6. Expiration time
7. Creation time
8. Creation time
9. Record delimiter (*)

If you are looking for something to decode these values try Galleta which
is available from
http://sourceforge.net/project/showfiles.php?group_id=78332

Regards,
Jim Halfpenny


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------