private void GetFirefoxHistory() { System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(firefoxHistoryMatch); String baseUserFolder = Environment.ExpandEnvironmentVariables("%SYSTEMDRIVE%\\Users"); foreach (var userfolder in System.IO.Directory.GetDirectories(baseUserFolder)) { String user = userfolder.Replace(baseUserFolder, "").Replace("\\", "");; String folder = System.IO.Path.Combine(userfolder, "AppData", "Roaming", "Mozilla", "Firefox", "Profiles"); if (System.IO.Directory.Exists(folder)) { foreach (var profile in Directory.GetDirectories(folder, "*.default")) { String history = safeReadFile(Path.Combine(profile, "places.sqlite")); foreach (System.Text.RegularExpressions.Match match in regex.Matches(history)) { var o = new BrowserHistory() { User = user, Browser = "Firefox", Url = match.Value }; WriteObject(o); } } } } }
private void GetIETypedUrls() { System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(ieregexUserMatch); foreach (String subkey in Microsoft.Win32.Registry.Users.GetSubKeyNames()) { if (regex.IsMatch(subkey)) { var user = new System.Security.Principal.SecurityIdentifier(subkey).Translate(typeof(System.Security.Principal.NTAccount)); using (var key = Microsoft.Win32.Registry.Users.OpenSubKey(subkey + "\\Software\\Microsoft\\Internet Explorer\\TypedURLs")) { foreach (String valName in key.GetValueNames()) { String val = key.GetValue(valName) as String; var o = new BrowserHistory() { User = user.Value, Browser = "IE_Typed", Url = val }; WriteObject(o); } } } } }
private void GetChromeHistory() { System.Text.RegularExpressions.Regex regex = new System.Text.RegularExpressions.Regex(chromeHistoryMatch); String baseUserFolder = Environment.ExpandEnvironmentVariables("%SYSTEMDRIVE%\\Users"); foreach (var userfolder in System.IO.Directory.GetDirectories(baseUserFolder)) { String user = userfolder.Replace(baseUserFolder, "").Replace("\\", ""); String[] locs = new String[] { "Local", "LocalLow", "Roaming" }; foreach (var l in locs) { String chromeFolder = System.IO.Path.Combine(userfolder, "AppData", l, "Google", "Chrome", "User Data"); if (System.IO.Directory.Exists(chromeFolder)) { List <String> profiles = new List <string>(new String[] { Path.Combine(chromeFolder, "Default") }); profiles.AddRange(Directory.GetDirectories(chromeFolder, "*Profile*")); foreach (var folder in profiles) { String profile = Path.GetFileName(folder); if (System.IO.Directory.Exists(folder)) { String historyFile = Path.Combine(folder, "History"); if (File.Exists(historyFile)) { String history = safeReadFile(historyFile); foreach (System.Text.RegularExpressions.Match match in regex.Matches(history)) { var o = new BrowserHistory() { User = user + ":" + profile, Browser = "Chrome", Url = match.Value }; WriteObject(o); } } } } } } } }
internal BrowserHistory[] GetHistory_WinINet() { List <BrowserHistory> history = new List <BrowserHistory>(); IntPtr vHandle; INTERNET_CACHE_ENTRY_INFOW vInternetCacheEntryInfo = new INTERNET_CACHE_ENTRY_INFOW(); uint vFirstCacheEntryInfoBufferSize = 0; FindFirstUrlCacheEntryEx(null, 0, NORMAL_CACHE_ENTRY, 0, (IntPtr)null, ref vFirstCacheEntryInfoBufferSize, null, null, null); IntPtr vBuffer = Marshal.AllocHGlobal((int)vFirstCacheEntryInfoBufferSize); vHandle = FindFirstUrlCacheEntryEx(null, 0, NORMAL_CACHE_ENTRY, 0, vBuffer, ref vFirstCacheEntryInfoBufferSize, null, null, null); while (vHandle != null) { Marshal.PtrToStructure(vBuffer, vInternetCacheEntryInfo); var bh = new BrowserHistory() { User = "******", Browser = "WinINet", Url = vInternetCacheEntryInfo.lpszSourceUrlName, Timestamp = FromFileTime(vInternetCacheEntryInfo.LastAccessTime) }; history.Add(bh); Marshal.FreeCoTaskMem(vBuffer); FindNextUrlCacheEntryEx(vHandle, (IntPtr)null, ref vFirstCacheEntryInfoBufferSize, null, null, null); vBuffer = Marshal.AllocHGlobal((int)vFirstCacheEntryInfoBufferSize); if (!FindNextUrlCacheEntryEx(vHandle, vBuffer, ref vFirstCacheEntryInfoBufferSize, null, null, null)) { break; } } Marshal.FreeCoTaskMem(vBuffer); return(history.ToArray()); }
internal BrowserHistory[] GetHistory_IE() { List <BrowserHistory> history = new List <BrowserHistory>(); IUrlHistoryStg2 vUrlHistoryStg2 = (IUrlHistoryStg2) new UrlHistory(); IEnumSTATURL vEnumSTATURL = vUrlHistoryStg2.EnumUrls(); STATURL vSTATURL; uint vFectched; while (vEnumSTATURL.Next(1, out vSTATURL, out vFectched) == 0) { var bh = new BrowserHistory() { User = "******", Browser = "IE", Url = vSTATURL.pwcsUrl, Timestamp = FromFileTime(vSTATURL.ftLastVisited) }; history.Add(bh); } //vUrlHistoryStg2.ClearHistory();//Clear the history return(history.ToArray()); }