FAW Tool Review Part 2

FAWlogo

Data Storage

LCDI; Nick Aspinwall

RECAP:

We want to open this blog up by just talking really quickly about what we have done so far.  In the past few weeks, we have set up a VMware Workstation Virtual Machine running windows 7 64 bit Pro and installed FAW.  We used user-agents to mimic Google Chrome, Mozilla Firefox, and Internet Explorer.  We captured www.Amazon.com, www.Woot.com, and www.lcdi.champlain.edu.  Our next step is to capture streaming video and see what data we can obtain.

Because we have captured these websites from three separate browsers, we wanted to learn how each browser stores the data.  Through our analysis, we discovered that they all store the data in the same structure.  So our next step was to break down the file structure of FAW and see what data of interest each file contains.  Below is a brief breakdown of the FAW file structure.

FAW_2_IMAGE1

 

Figure 1: FAW creates two base folders: FAW and FAWConfiguration.
 

FAW_2_IMAGE2

 

Figure 2: Inside the FAWConfiguration file, we see two files: Application text file and Configuration XML file.

FAW_2_IMAGE3

 

 

 

 

Figure 3: Inside the FAW folder, we see a folder was created for each case that was created.

FAW_2_IMAGE4

 

Figure 4: This is the folder created within each case folder. Each folder is an acquisition or capture conducted by the investigator.

FAW_2_IMAGE5

 

 

 

 

 

Figure 5: Located inside the numbered folders above, these are the files that contain all the data from each acquisition or capture.

 

We will be going into each file in an effort to see what they contain and how that data can be useful.  Overall, this structure seems organized.  Furthermore, depending on how you name each case and acquisition, it can be very easy to keep track of your files.  Though with this system, it is possible to accumulate a large amount of numbered folders with each capture,  and these may be harder to locate and use.  In our opinion, it may be helpful to make note of which folder contains the webpage that was captured.

www.FawProject.com claims that the tool is capable of capturing streaming video, as well as “client side effects” such as javascript, jquery, and flash.  This also includes streaming data.  Our next step is to to attempt to capture a streaming video (or a page with streaming data) and see what files are created.

UPDATE:

Since our last data was captured, an update released (FAW Version 2.1.0.0).  We were using FAW 2.0.0.4 for our project, but we will now be using  2.1.0.0 to recapture the websites.  With this update, the website reports that the tool can no capture “all objects” connected to the webpage.  This was briefly tested by our team, and we discovered that an Objects folder is created within the acquisition folder (figure 4).  These objects range from javascript files to image files. Figure 6 shows a snippet of the files located inside the Objects folder.

FAW_2_IMAGE6

 

 

 

 

One thought on “FAW Tool Review Part 2

  1. Dawood Khan

    Hi there,I enjoy reading through your article post, I wanted to write a little comment to support you and wish you a good continuationAll the best for all your blogging efforts.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Current day month ye@r *