Final Week to Get a Free GIAC Certification Attempt or Take $350 Off with OnDemand & vLive!


To attend this webcast, login to your SANS Account or create your Account.

  • Thursday, May 11th, 2017 at 11:00 AM EDT (15:00:00 UTC)
  • Phillip Moore
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


Google's market share in the search engine space ensures that it is usually the first port of call when someone needs information. Google, being the data-driven company that it is, likes to record data about the user's activity, some of which is hidden in plain sight in the URL string.This treasure trove of cryptic data extends well beyond the humble search term. As Google Search artifacts are found on just about every examination, this presentation will take a look at what information we can decode from the Google URLs found in Internet History and Cache to assist in determining a user's actions, and, where possible, adding reliability to the times in our timelines.

To learn more on this topic, attend the 10th annual SANS Digital Forensics & Incident Response (DFIR) Summit & Training. This training event brings together the most influential group of experts, the highest quality training, and the greatest industry networking opportunities in one place. Over the course of this eight-day training event, you'll enjoy:

  • Highly technical digital forensics and incident response presentations from the industry's top practitioners during the two-day Summit
  • Nine SANS DFIR courses to choose from to advance your training, build your arsenal of defenses, and learn how to better protect your organization
  • The opportunity to network with fellow attendees at receptions and community-building events
  • A DFIR NetWars tournament to sharpen your skills and solve incident-related challenges

Speaker Bio

Phill Moore

Phill Moore is a digital forensic analyst working in law enforcement in Sydney, Australia. Over the past six years, Phill has worked on hundreds of digital devices relating to local, state, and supreme court matters. In his spare time, Phill writes the ‘This Week In 4n6’ blog summarising the weekly happenings in the DFIR community.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.