private void GetFirefoxHistory()
{
System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(firefoxHistoryMatch);
String baseUserFolder = Environment.ExpandEnvironmentVariables("%SYSTEMDRIVE%\\Users");
foreach (var userfolder in System.IO.Directory.GetDirectories(baseUserFolder))
{
String user = userfolder.Replace(baseUserFolder, "").Replace("\\", "");;
String folder = System.IO.Path.Combine(userfolder, "AppData", "Roaming", "Mozilla", "Firefox", "Profiles");
if (System.IO.Directory.Exists(folder))
{
foreach (var profile in Directory.GetDirectories(folder, "*.default"))
{
String history = safeReadFile(Path.Combine(profile, "places.sqlite"));
foreach (System.Text.RegularExpressions.Match match in regex.Matches(history))
{
var o = new BrowserHistory()
{
User = user,
Browser = "Firefox",
Url = match.Value
};
WriteObject(o);
}
}
}
}
}
private void GetIETypedUrls()
{
System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(ieregexUserMatch);
foreach (String subkey in Microsoft.Win32.Registry.Users.GetSubKeyNames())
{
if (regex.IsMatch(subkey))
{
var user = new System.Security.Principal.SecurityIdentifier(subkey).Translate(typeof(System.Security.Principal.NTAccount));
using (var key = Microsoft.Win32.Registry.Users.OpenSubKey(subkey + "\\Software\\Microsoft\\Internet Explorer\\TypedURLs"))
{
foreach (String valName in key.GetValueNames())
{
String val = key.GetValue(valName) as String;
var o = new BrowserHistory()
{
User = user.Value,
Browser = "IE_Typed",
Url = val
};
WriteObject(o);
}
}
}
}
}
private void GetChromeHistory()
{
System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(chromeHistoryMatch);
String baseUserFolder = Environment.ExpandEnvironmentVariables("%SYSTEMDRIVE%\\Users");
foreach (var userfolder in System.IO.Directory.GetDirectories(baseUserFolder))
{
String user = userfolder.Replace(baseUserFolder, "").Replace("\\", "");
String[] locs = new String[] { "Local", "LocalLow", "Roaming" };
foreach (var l in locs)
{
String chromeFolder = System.IO.Path.Combine(userfolder, "AppData", l, "Google", "Chrome", "User Data");
if (System.IO.Directory.Exists(chromeFolder))
{
List <String> profiles = new List <string>(new String[] { Path.Combine(chromeFolder, "Default") });
profiles.AddRange(Directory.GetDirectories(chromeFolder, "*Profile*"));
foreach (var folder in profiles)
{
String profile = Path.GetFileName(folder);
if (System.IO.Directory.Exists(folder))
{
String historyFile = Path.Combine(folder, "History");
if (File.Exists(historyFile))
{
String history = safeReadFile(historyFile);
foreach (System.Text.RegularExpressions.Match match in regex.Matches(history))
{
var o = new BrowserHistory()
{
User = user + ":" + profile,
Browser = "Chrome",
Url = match.Value
};
WriteObject(o);
}
}
}
}
}
}
}
}
internal BrowserHistory[] GetHistory_WinINet()
{
List <BrowserHistory> history = new List <BrowserHistory>();
IntPtr vHandle;
INTERNET_CACHE_ENTRY_INFOW vInternetCacheEntryInfo = new INTERNET_CACHE_ENTRY_INFOW();
uint vFirstCacheEntryInfoBufferSize = 0;
FindFirstUrlCacheEntryEx(null, 0, NORMAL_CACHE_ENTRY, 0, (IntPtr)null,
ref vFirstCacheEntryInfoBufferSize, null, null, null);
IntPtr vBuffer = Marshal.AllocHGlobal((int)vFirstCacheEntryInfoBufferSize);
vHandle = FindFirstUrlCacheEntryEx(null, 0, NORMAL_CACHE_ENTRY, 0,
vBuffer, ref vFirstCacheEntryInfoBufferSize,
null, null, null);
while (vHandle != null)
{
Marshal.PtrToStructure(vBuffer, vInternetCacheEntryInfo);
var bh = new BrowserHistory()
{
User = "******",
Browser = "WinINet",
Url = vInternetCacheEntryInfo.lpszSourceUrlName,
Timestamp = FromFileTime(vInternetCacheEntryInfo.LastAccessTime)
};
history.Add(bh);
Marshal.FreeCoTaskMem(vBuffer);
FindNextUrlCacheEntryEx(vHandle, (IntPtr)null, ref vFirstCacheEntryInfoBufferSize,
null, null, null);
vBuffer = Marshal.AllocHGlobal((int)vFirstCacheEntryInfoBufferSize);
if (!FindNextUrlCacheEntryEx(vHandle, vBuffer,
ref vFirstCacheEntryInfoBufferSize, null, null, null))
{
break;
}
}
Marshal.FreeCoTaskMem(vBuffer);
return(history.ToArray());
}
internal BrowserHistory[] GetHistory_IE()
{
List <BrowserHistory> history = new List <BrowserHistory>();
IUrlHistoryStg2 vUrlHistoryStg2 = (IUrlHistoryStg2) new UrlHistory();
IEnumSTATURL vEnumSTATURL = vUrlHistoryStg2.EnumUrls();
STATURL vSTATURL;
uint vFectched;
while (vEnumSTATURL.Next(1, out vSTATURL, out vFectched) == 0)
{
var bh = new BrowserHistory()
{
User = "******",
Browser = "IE",
Url = vSTATURL.pwcsUrl,
Timestamp = FromFileTime(vSTATURL.ftLastVisited)
};
history.Add(bh);
}
//vUrlHistoryStg2.ClearHistory();//Clear the history
return(history.ToArray());
}
