Google's market share in the search engine space ensures that it is usually the first port of call when someone needs information. Google, being the data-driven company that it is, likes to record data about the user's activity, some of which is hidden in plain sight in the URL string.This treasure trove of cryptic data extends well beyond the humble search term. As Google Search artifacts are found on just about every examination, this presentation will take a look at what information we can decode from the Google URLs found in Internet History and Cache to assist in determining a user's actions, and, where possible, adding reliability to the times in our timelines.
To learn more on this topic, attend the 10th annual SANS Digital Forensics & Incident Response (DFIR) Summit & Training. This training event brings together the most influential group of experts, the highest quality training, and the greatest industry networking opportunities in one place. Over the course of this eight-day training event, you'll enjoy: