We've been busy here on team agent at MANDIANT. In the spirit of our long-standing support of free software in the Incident Response community, we are happy to announce the release of Web Historian 2.0. This release is a complete rewrite and revamp of our very popular web history extraction tool. This version of Web Historian comes packed with features and supports Firefox 2/3+, Chrome 3+, and Internet Explorer versions 5 through 8. Here is a quick run-down of some of the new features:

• Collects web history, cookie history, file download history, and form history into data sets
• Simple/powerful UI based on tabbed organization of datasets
• Perform a live artifact scan of the local system
• Perform an artifact scan of one or more arbitrary history files from all supported browsers
• Import results from existing XML scan documents
• Data displayed in gridview style with full search, sort, and filter capabilities
• Custom filters can be created and applied to one or more data sets
• Export data sets to XML, HTML or CSV
• Extract and export history files used in live artifact scan
• Quick copy/paste selected gridview rows to clipboard
• Customizable scan settings can tweak the scan to target specific browsers and data sets
• Right-click context menu for narrowing gridview data instantly
• Select which columns to display in each dataset
• View page thumbnails and indexed content
• Export sanitized version of history results to distribute to others
• Website Analyzer provides visualization of datasets using bar graphs, pie charts and timelines
• Website Profiler shows a quick "report card" of artifacts for various websites

The custom filters mentioned above are extremely useful for narrowing the scope of your web history investigation. Web Historian ships with several pre-defined filters that allow you to quickly cull through large web history data sets. For example, you can instantly filter the web history data by visit type to only show hidden page views caused by ads; or, filter the file download history data to only show downloaded media (movies, images, etc.), PDF's, or plain text files. You can easily create your own filters using the filter editor and configure Web Historian to automatically save any of your searches as filters. Finally, more filters are accessible with a simple right-click on any web history item.

Also new in Web Historian 2.0 are the Website Analyzer and Website Profiler features. The Website Analyzer allows you to visualize web history data (rather than scrolling through pages of records) and generate useful bar graphs, pie charts and timeline plots that can be used in an external report. The Website Profiler generates a quick "report card" summary of any domain in your web history data, showing all artifacts created on your system when it was visited (page titles, cookies, cached files, form data, etc). This feature allows you to get a quick impression of how a site behaves. The screenshot below shows the profile of CNN.com:

We hope you enjoy the new features in this release of Web Historian. As usual, if you have any questions, comments or feedback, please head on over to the user forum.

Stay tuned for even more exciting features coming soon! If you would like a demo or talk to me about features, I will be at Blackhat USA in Las Vegas this summer and hope to be accepted to demo Web Historian 2.0 at Blackhat Arsenal. And finally, don't miss out on our memory forensics training at Blackhat: Advanced Memory Forensics in Incident Response.