├── IE10Analyzer ├── icon │ ├── All.ico │ ├── Csv.ico │ ├── Check.ico │ ├── Clock.ico │ ├── Close.ico │ ├── Open.ico │ ├── Sheet.ico │ ├── View.ico │ ├── Checked.ico │ ├── Database.ico │ ├── Detail.ico │ ├── Install.ico │ ├── SaveAs.ico │ ├── Search.ico │ ├── progress.ico │ ├── IE10Analyzer.ico │ └── IE10Analyzer.png ├── IEForensic.suo ├── dll │ ├── Esent.Interop.dll │ ├── ExtractFiles.dll │ ├── System.Data.SQLite.dll │ └── WeifenLuo.WinFormsUI.Docking.dll ├── IEForensic │ ├── IE10Analyzer.ico │ ├── Resources │ │ ├── ExtractFiles.dll │ │ ├── IE10Analyzer.png │ │ ├── Esent.Interop.dll │ │ ├── System.Data.SQLite.dll │ │ └── WeifenLuo.WinFormsUI.Docking.dll │ ├── bin │ │ ├── Debug │ │ │ ├── IE10Analyzer.exe │ │ │ ├── Esent.Interop.dll │ │ │ ├── System.Data.SQLite.dll │ │ │ └── WeifenLuo.WinFormsUI.Docking.dll │ │ └── Release │ │ │ ├── IE10Analyzer.exe │ │ │ ├── Esent.Interop.dll │ │ │ ├── System.Data.SQLite.dll │ │ │ └── WeifenLuo.WinFormsUI.Docking.dll │ ├── app.config │ ├── EDBParser │ │ ├── app.config │ │ ├── Column.cs │ │ ├── LVItem.cs │ │ ├── ColType.cs │ │ ├── DatabaseHeader.cs │ │ ├── MSysObjects.cs │ │ └── Item.cs │ ├── Properties │ │ ├── Settings.settings │ │ ├── Settings.Designer.cs │ │ ├── AssemblyInfo.cs │ │ ├── app.manifest │ │ └── Resources.Designer.cs │ ├── About.cs │ ├── ColumnInformation.cs │ ├── Settings.cs │ ├── FormWait.cs │ ├── CsvFileWriter.cs │ ├── Program.cs │ ├── DockSearch.cs │ ├── ListViewItemComparer.cs │ ├── FormDetailView.cs │ ├── HexReader.cs │ ├── SqlManager.cs │ ├── DockTableList.cs │ ├── FormWait.Designer.cs │ ├── About.Designer.cs │ ├── DockTableList.Designer.cs │ ├── FormInputUTCTime.Designer.cs │ ├── FormDetailView.Designer.cs │ ├── FormSave.Designer.cs │ ├── DockRecordList.Designer.cs │ ├── DockSearch.Designer.cs │ ├── FormSave.cs │ ├── IEForensic.csproj │ ├── FormInputUTCTime.cs │ ├── FormOpen.Designer.cs │ ├── FormMain.Designer.cs │ └── FormOpen.cs └── IEForensic.sln ├── README.md └── LICENSE /IE10Analyzer/icon/All.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/All.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Csv.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Csv.ico -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic.suo -------------------------------------------------------------------------------- /IE10Analyzer/icon/Check.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Check.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Clock.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Clock.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Close.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Close.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Open.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Open.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Sheet.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Sheet.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/View.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/View.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Checked.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Checked.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Database.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Database.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Detail.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Detail.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Install.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Install.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/SaveAs.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/SaveAs.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/Search.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/Search.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/progress.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/progress.ico -------------------------------------------------------------------------------- /IE10Analyzer/dll/Esent.Interop.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/dll/Esent.Interop.dll -------------------------------------------------------------------------------- /IE10Analyzer/dll/ExtractFiles.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/dll/ExtractFiles.dll -------------------------------------------------------------------------------- /IE10Analyzer/icon/IE10Analyzer.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/IE10Analyzer.ico -------------------------------------------------------------------------------- /IE10Analyzer/icon/IE10Analyzer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/icon/IE10Analyzer.png -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/IE10Analyzer.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/IE10Analyzer.ico -------------------------------------------------------------------------------- /IE10Analyzer/dll/System.Data.SQLite.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/dll/System.Data.SQLite.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Resources/ExtractFiles.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/Resources/ExtractFiles.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Resources/IE10Analyzer.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/Resources/IE10Analyzer.png -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Debug/IE10Analyzer.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Debug/IE10Analyzer.exe -------------------------------------------------------------------------------- /IE10Analyzer/dll/WeifenLuo.WinFormsUI.Docking.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/dll/WeifenLuo.WinFormsUI.Docking.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Resources/Esent.Interop.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/Resources/Esent.Interop.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Debug/Esent.Interop.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Debug/Esent.Interop.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Release/IE10Analyzer.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Release/IE10Analyzer.exe -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Release/Esent.Interop.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Release/Esent.Interop.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Resources/System.Data.SQLite.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/Resources/System.Data.SQLite.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Debug/System.Data.SQLite.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Debug/System.Data.SQLite.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Release/System.Data.SQLite.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Release/System.Data.SQLite.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Resources/WeifenLuo.WinFormsUI.Docking.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/Resources/WeifenLuo.WinFormsUI.Docking.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Debug/WeifenLuo.WinFormsUI.Docking.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Debug/WeifenLuo.WinFormsUI.Docking.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/bin/Release/WeifenLuo.WinFormsUI.Docking.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/moaistory/IE10Analyzer/HEAD/IE10Analyzer/IEForensic/bin/Release/WeifenLuo.WinFormsUI.Docking.dll -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/app.config: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Properties/Settings.settings: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/About.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | 10 | namespace IE10Analyzer 11 | { 12 | public partial class About : Form 13 | { 14 | public About() 15 | { 16 | InitializeComponent(); 17 | } 18 | 19 | private void linkLabel1_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) 20 | { 21 | System.Diagnostics.Process.Start("http://moaistory.blogspot.com/2016/07/internet-explorer-10-microsoft-edge.html"); 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # IE10Analyzer 2 | 3 | http://moaistory.blogspot.com/2016/08/ie10analyzer.html 4 | 5 | This tool can parse normal records and recover deleted records in WebCacheV01.dat. 6 | 7 | WebCacheV01.dat is used in Internet Explorer 10 or 11 and Edge Browser. 8 | 9 | IE10Analyzer Advantages : 10 | 11 | - IE10Analyzer can recovery deleted records. 12 | - IE10Analyzer can view contents about InPrivate Browsing. 13 | - IE10Analyzer can extract and analyze WebCacheV01.dat from live system. 14 | - Regardless of status of the file, IE10Analyzer can parse any file. (Dirty status is OK) 15 | - IE10Analyzer shows more information than the other tools . 16 | (Download file information, HTTP Response Header, Web Page Title) 17 | - IE10Analyzer can convert from ESE database to another form : CSV, sqlite 18 | - IE10Analyzer can apply to UTC time. 19 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/Column.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | 6 | namespace IE10Analyzer.EDBParser 7 | { 8 | public class Column 9 | { 10 | private int id; 11 | private int type; 12 | private int spaceUsage; 13 | private string name; 14 | public Column() { } 15 | 16 | public Column(int id, int type, int spaceUsage, string name) 17 | { 18 | this.id = id; 19 | this.type = type; 20 | this.spaceUsage = spaceUsage; 21 | this.name = name; 22 | } 23 | 24 | 25 | public int getID() 26 | { 27 | return this.id; 28 | } 29 | 30 | public int getType() 31 | { 32 | return this.type; 33 | } 34 | 35 | public int getSpaceUsage() 36 | { 37 | return this.spaceUsage; 38 | } 39 | 40 | public string getName() 41 | { 42 | return this.name; 43 | } 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/LVItem.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | 6 | namespace IE10Analyzer.EDBParser 7 | { 8 | public class LVItem 9 | { 10 | private HexReader hexReader; 11 | private int lvPtrNumber; 12 | private int totalSize; 13 | private List dataList; 14 | public LVItem(){} 15 | public LVItem(HexReader hexReader, int lvPtrNumber, int totalSize){ 16 | this.hexReader = hexReader; 17 | this.lvPtrNumber = lvPtrNumber; 18 | this.totalSize = totalSize; 19 | this.dataList = new List(); 20 | } 21 | 22 | 23 | public void addData(Item item){ 24 | this.dataList.Add(item); 25 | } 26 | 27 | public string getData(int id, ColType.TYPE type){ 28 | string value = ""; 29 | foreach(Item item in this.dataList){ 30 | item.setIdType(id, type); 31 | value += item.getValue(); 32 | } 33 | 34 | return value; 35 | } 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 Jeonghyeon Kim 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/ColumnInformation.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using Microsoft.Isam.Esent.Interop; 6 | namespace IE10Analyzer 7 | { 8 | 9 | public class ColumnInformation 10 | { 11 | public ColumnInformation(JET_coltyp coltyp, int colId, int maxLength, String name) 12 | { 13 | this.coltyp = coltyp; 14 | this.colId = colId; 15 | this.maxLength = maxLength; 16 | this.name = name; 17 | } 18 | private JET_coltyp coltyp; 19 | private int colId; 20 | private int maxLength; 21 | private String name; 22 | 23 | public String getName() 24 | { 25 | return this.name; 26 | } 27 | public int getId() 28 | { 29 | return this.colId; 30 | } 31 | 32 | public JET_coltyp getColType() 33 | { 34 | return this.coltyp; 35 | } 36 | 37 | public int getMaxLength() 38 | { 39 | return this.maxLength; 40 | } 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Properties/Settings.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // 이 코드는 도구를 사용하여 생성되었습니다. 4 | // 런타임 버전:4.0.30319.18063 5 | // 6 | // 파일 내용을 변경하면 잘못된 동작이 발생할 수 있으며, 코드를 다시 생성하면 7 | // 이러한 변경 내용이 손실됩니다. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace IEForensic.Properties { 12 | 13 | 14 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 15 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")] 16 | public sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase { 17 | 18 | private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); 19 | 20 | public static Settings Default { 21 | get { 22 | return defaultInstance; 23 | } 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Settings.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer.Properties { 2 | 3 | 4 | // 이 클래스를 사용하여 설정 클래스에 대한 특정 이벤트를 처리할 수 있습니다. 5 | // SettingChanging 이벤트는 설정 값이 변경되기 전에 발생합니다. 6 | // PropertyChanged 이벤트는 설정 값이 변경된 후에 발생합니다. 7 | // SettingsLoaded 이벤트는 설정 값이 로드된 후에 발생합니다. 8 | // SettingsSaving 이벤트는 설정 값이 저장되기 전에 발생합니다. 9 | public sealed partial class Settings { 10 | 11 | public Settings() { 12 | // // 설정을 저장 및 변경하기 위한 이벤트 처리기를 추가하려면 아래 줄에서 주석 처리를 제거하십시오. 13 | // 14 | // this.SettingChanging += this.SettingChangingEventHandler; 15 | // 16 | // this.SettingsSaving += this.SettingsSavingEventHandler; 17 | // 18 | } 19 | 20 | private void SettingChangingEventHandler(object sender, System.Configuration.SettingChangingEventArgs e) { 21 | // SettingChangingEvent 이벤트를 처리하는 코드를 여기에 추가하십시오. 22 | } 23 | 24 | private void SettingsSavingEventHandler(object sender, System.ComponentModel.CancelEventArgs e) { 25 | // SettingsSaving 이벤트를 처리하는 코드를 여기에 추가하십시오. 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/ColType.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | 6 | namespace IE10Analyzer.EDBParser 7 | { 8 | public class ColType 9 | { 10 | public enum TYPE 11 | { 12 | JET_coltypNil = 0, //null 13 | JET_coltypBit = 1, //boolean 14 | JET_coltypUnsignedByte = 2, //byte 15 | JET_coltypShort = 3, //short 16 | JET_coltypLong = 4, //integer 17 | JET_coltypCurrency = 5, //Currency (64-bit) 18 | JET_coltypIEEESingle = 6, //float 19 | JET_coltypIEEEDouble = 7, //double 20 | JET_coltypDateTime = 8, //time 21 | JET_coltypBinary = 9, //binary 22 | JET_coltypText = 10, //text 23 | JET_coltypLongBinary = 11, //long binary 24 | JET_coltypLongText = 12, //long text 25 | JET_coltypSLV = 13, //long value 26 | JET_coltypUnsignedLong = 14, //unsigned integer 27 | JET_coltypLongLong = 15, //long long 28 | JET_coltypGUID = 16, //text 29 | JET_coltypUnsignedShort = 17, //unsigned short 30 | UNKNOWN_TYPE = -1 //unknown type 31 | }; 32 | } 33 | } 34 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // 어셈블리의 일반 정보는 다음 특성 집합을 통해 제어됩니다. 6 | // 어셈블리와 관련된 정보를 수정하려면 7 | // 이 특성 값을 변경하십시오. 8 | [assembly: AssemblyTitle("IE10Analyzer")] 9 | [assembly: AssemblyDescription("This tool parse records and recovery deleted records from WebCachev01.dat")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("Jeonghyeon Kim")] 12 | [assembly: AssemblyProduct("IE10Analyzer")] 13 | [assembly: AssemblyCopyright("Jeonghyeon Kim")] 14 | [assembly: AssemblyTrademark("Jeonghyeon Kim")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // ComVisible을 false로 설정하면 이 어셈블리의 형식이 COM 구성 요소에 18 | // 표시되지 않습니다. COM에서 이 어셈블리의 형식에 액세스하려면 19 | // 해당 형식에 대해 ComVisible 특성을 true로 설정하십시오. 20 | [assembly: ComVisible(false)] 21 | 22 | // 이 프로젝트가 COM에 노출되는 경우 다음 GUID는 typelib의 ID를 나타냅니다. 23 | [assembly: Guid("dd55727f-f0d9-4aa1-af86-4cf4d4f7308e")] 24 | 25 | // 어셈블리의 버전 정보는 다음 네 가지 값으로 구성됩니다. 26 | // 27 | // 주 버전 28 | // 부 버전 29 | // 빌드 번호 30 | // 수정 버전 31 | // 32 | // 모든 값을 지정하거나 아래와 같이 '*'를 사용하여 빌드 번호 및 수정 버전이 자동으로 33 | // 지정되도록 할 수 있습니다. 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.6")] 36 | [assembly: AssemblyFileVersion("1.0.0.6")] 37 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormWait.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | 10 | namespace IE10Analyzer 11 | { 12 | public partial class FormWait : Form 13 | { 14 | int maximum = 100; 15 | public FormWait() 16 | { 17 | InitializeComponent(); 18 | } 19 | 20 | public void setStyle(ProgressBarStyle style) 21 | { 22 | progressBar.Style = style; 23 | } 24 | 25 | public void setPrgress(int value) 26 | { 27 | try 28 | { 29 | progressBar.Maximum = maximum + 1; 30 | progressBar.Value = value + 1; 31 | progressBar.Maximum = maximum; 32 | progressBar.Value = value; 33 | labelPecentage.Text = "(" + value.ToString() + "/" + progressBar.Maximum + ")"; 34 | } 35 | catch { } 36 | } 37 | 38 | public void setPercent(int value) 39 | { 40 | labelPecentage.Text = "(" + value + "%)"; 41 | } 42 | public void maxProgress(int value) 43 | { 44 | maximum = value; 45 | 46 | } 47 | public void end(String message) 48 | { 49 | labelPecentage.Text = message; 50 | } 51 | 52 | public void setLabel(String message) 53 | { 54 | label.Text = message; 55 | } 56 | 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 11.00 3 | # Visual Studio 2010 4 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "IEForensic", "IEForensic\IEForensic.csproj", "{33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}" 5 | EndProject 6 | Global 7 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 8 | Debug|Any CPU = Debug|Any CPU 9 | Debug|x64 = Debug|x64 10 | Debug|x86 = Debug|x86 11 | Release|Any CPU = Release|Any CPU 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 17 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|Any CPU.Build.0 = Debug|Any CPU 18 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|x64.ActiveCfg = Debug|x64 19 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|x64.Build.0 = Debug|x64 20 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|x86.ActiveCfg = Debug|x86 21 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Debug|x86.Build.0 = Debug|x86 22 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|Any CPU.ActiveCfg = Release|Any CPU 23 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|Any CPU.Build.0 = Release|Any CPU 24 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|x64.ActiveCfg = Release|x64 25 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|x64.Build.0 = Release|x64 26 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|x86.ActiveCfg = Release|x86 27 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B}.Release|x86.Build.0 = Release|x86 28 | EndGlobalSection 29 | GlobalSection(SolutionProperties) = preSolution 30 | HideSolutionNode = FALSE 31 | EndGlobalSection 32 | EndGlobal 33 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/DatabaseHeader.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | 6 | namespace IE10Analyzer.EDBParser 7 | { 8 | public class DatabaseHeader 9 | { 10 | private HexReader hexReader; 11 | private int signature; 12 | private int version; 13 | private int status; 14 | private int revision; 15 | private int pagesize; 16 | 17 | public DatabaseHeader() 18 | { 19 | } 20 | 21 | 22 | public DatabaseHeader(HexReader hexReader) 23 | { 24 | this.hexReader = hexReader; 25 | } 26 | 27 | 28 | 29 | /***** private method ****/ 30 | 31 | 32 | /***** public method *****/ 33 | 34 | public void parseHeaderArea() 35 | { 36 | this.signature = this.hexReader.readInt(0x04); 37 | this.version = this.hexReader.readInt(0x08); 38 | this.status = this.hexReader.readInt(0x34); 39 | this.revision = this.hexReader.readInt(0xE8); 40 | this.pagesize = this.hexReader.readInt(0xEC); 41 | } 42 | public void setHexReader(HexReader hexReader) 43 | { 44 | this.hexReader = hexReader; 45 | } 46 | 47 | 48 | public int getSignature() 49 | { 50 | return this.signature; 51 | } 52 | 53 | public int getVersion() 54 | { 55 | return this.version; 56 | } 57 | 58 | public int getStatus() 59 | { 60 | return this.status; 61 | } 62 | 63 | public int getRevision() 64 | { 65 | return this.revision; 66 | } 67 | 68 | public int getPagesize() 69 | { 70 | return this.pagesize; 71 | } 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/CsvFileWriter.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.IO; 6 | 7 | 8 | namespace IE10Analyzer 9 | { 10 | /// 11 | /// Class to write data to a CSV file 12 | /// 13 | public class CsvFileWriter : StreamWriter 14 | { 15 | public CsvFileWriter(Stream stream) 16 | : base(stream) 17 | { 18 | } 19 | public CsvFileWriter(Stream stream, Encoding encoding) 20 | : base(stream, encoding) 21 | { 22 | } 23 | 24 | public CsvFileWriter(string filename) 25 | : base(filename) 26 | { 27 | } 28 | 29 | /// 30 | /// Writes a single row to a CSV file. 31 | /// 32 | /// The row to be written 33 | public void WriteRow(List rows) 34 | { 35 | StringBuilder builder = new StringBuilder(); 36 | bool firstColumn = true; 37 | foreach (string row in rows) 38 | { 39 | string value = row.Replace(Environment.NewLine, "[NewLine]"); 40 | // Add separator if this isn't the first value 41 | if (!firstColumn) 42 | builder.Append(','); 43 | // Implement special handling for values that contain comma or quote 44 | // Enclose in quotes and double up any double quotes 45 | if (value.IndexOfAny(new char[] { '"', ',' }) != -1) 46 | builder.AppendFormat("\"{0}\"", value.Replace("\"", "\"\"")); 47 | else 48 | builder.Append(value); 49 | firstColumn = false; 50 | } 51 | WriteLine(builder.ToString()); 52 | } 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Windows.Forms; 5 | using System; 6 | using System.Reflection; 7 | 8 | [assembly: Obfuscation(Feature = "ignore error EF-1099", StripAfterObfuscation = false)] 9 | 10 | namespace IE10Analyzer 11 | { 12 | 13 | static class Program 14 | { 15 | /// 16 | /// 해당 응용 프로그램의 주 진입점입니다. 17 | /// 18 | [STAThread] 19 | static void Main() 20 | { 21 | AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(ResolveAssembly); 22 | Application.EnableVisualStyles(); 23 | Application.SetCompatibleTextRenderingDefault(false); 24 | Application.Run(new FormMain()); 25 | 26 | 27 | } 28 | // 리소스 dll 취득 29 | 30 | private static System.Reflection.Assembly ResolveAssembly(object sender, ResolveEventArgs args) 31 | { 32 | 33 | System.Reflection.Assembly thisAssembly = System.Reflection.Assembly.GetExecutingAssembly(); 34 | 35 | string name = args.Name.Substring(0, args.Name.IndexOf(',')) + ".dll"; 36 | 37 | var files = thisAssembly.GetManifestResourceNames().Where(s => s.EndsWith(name)); 38 | 39 | 40 | 41 | if (files.Count() > 0) 42 | { 43 | 44 | string fileName = files.First(); 45 | 46 | using (System.IO.Stream stream = thisAssembly.GetManifestResourceStream(fileName)) 47 | { 48 | 49 | if (stream != null) 50 | { 51 | 52 | byte[] data = new byte[stream.Length]; 53 | 54 | stream.Read(data, 0, data.Length); 55 | 56 | return System.Reflection.Assembly.Load(data); 57 | 58 | } 59 | 60 | } 61 | 62 | } 63 | 64 | return null; 65 | 66 | } 67 | 68 | } 69 | } 70 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/DockSearch.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using WeifenLuo.WinFormsUI.Docking; 10 | 11 | namespace IE10Analyzer 12 | { 13 | public partial class DockSearch : DockContent 14 | { 15 | private FormMain formMain; 16 | public DockSearch(FormMain formMain) 17 | { 18 | InitializeComponent(); 19 | this.ClientSize = new System.Drawing.Size(50,50); 20 | this.ResumeLayout(true); 21 | this.formMain = formMain; 22 | } 23 | 24 | private void DockSearch_DockStateChanged(object sender, EventArgs e) 25 | { 26 | this.AutoHidePortion = 45; 27 | 28 | } 29 | 30 | private void DockSearch_Resize(object sender, EventArgs e) 31 | { 32 | textBoxSearch.Width = panel1.Width; 33 | } 34 | 35 | 36 | private void buttonSearch_Click(object sender, EventArgs e) 37 | { 38 | if (!formMain.searchListView(textBoxSearch.Text)) 39 | { 40 | MessageBox.Show("Cannot find : " + textBoxSearch.Text); 41 | } 42 | } 43 | 44 | private void buttonPrev_Click(object sender, EventArgs e) 45 | { 46 | if (!formMain.searchPrev()) 47 | { 48 | MessageBox.Show("This is the first!"); 49 | } 50 | } 51 | 52 | private void buttonNext_Click(object sender, EventArgs e) 53 | { 54 | if (!formMain.searchNext()) 55 | { 56 | MessageBox.Show("This is the last!"); 57 | } 58 | } 59 | protected override bool ProcessCmdKey(ref Message msg, Keys keyData) 60 | { 61 | if (keyData == (Keys.Enter)) 62 | { 63 | if (!formMain.searchListView(textBoxSearch.Text)) 64 | { 65 | MessageBox.Show("Cannot find : " + textBoxSearch.Text); 66 | } 67 | return true; 68 | } 69 | return base.ProcessCmdKey(ref msg, keyData); 70 | } 71 | } 72 | } 73 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Properties/app.manifest: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 47 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/ListViewItemComparer.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Collections; 6 | using System.Windows.Forms; 7 | 8 | namespace IE10Analyzer 9 | { 10 | public class ListViewItemComparer : IComparer 11 | { 12 | private int column; 13 | public string sort = "asc"; 14 | public ListViewItemComparer() 15 | { 16 | column = 0; 17 | } 18 | public ListViewItemComparer(int column, string sort) 19 | { 20 | this.column = column; 21 | this.sort = sort; 22 | } 23 | 24 | public int Compare(object x, object y) 25 | { 26 | if (!(x is ListViewItem)) 27 | return (0); 28 | if (!(y is ListViewItem)) 29 | return (0); 30 | 31 | ListViewItem l1 = (ListViewItem)x; 32 | ListViewItem l2 = (ListViewItem)y; 33 | 34 | if (l1.ListView.Columns[column].Tag == null) 35 | { 36 | l1.ListView.Columns[column].Tag = "Text"; 37 | } 38 | 39 | if (l1.ListView.Columns[column].Tag.ToString() == "Numeric") 40 | { 41 | float fl1 = float.Parse(l1.SubItems[column].Text); 42 | float fl2 = float.Parse(l2.SubItems[column].Text); 43 | 44 | if (sort == "asc") 45 | { 46 | return fl1.CompareTo(fl2); 47 | } 48 | else 49 | { 50 | return fl2.CompareTo(fl1); 51 | } 52 | } 53 | else 54 | { 55 | string str1 = l1.SubItems[column].Text; 56 | string str2 = l2.SubItems[column].Text; 57 | 58 | if (sort == "asc") 59 | { 60 | return str1.CompareTo(str2); 61 | } 62 | else 63 | { 64 | return str2.CompareTo(str1); 65 | } 66 | } 67 | 68 | /* 69 | 70 | if (sort == "asc") 71 | return String.Compare(((ListViewItem)x).SubItems[col].Text, ((ListViewItem)y).SubItems[col].Text); 72 | else 73 | return String.Compare(((ListViewItem)y).SubItems[col].Text, ((ListViewItem)x).SubItems[col].Text); 74 | * */ 75 | } 76 | } 77 | } 78 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormDetailView.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using IE10Analyzer.EDBParser; 10 | 11 | namespace IE10Analyzer 12 | { 13 | public partial class FormDetailView : Form 14 | { 15 | private ListViewItem listViewItem; 16 | 17 | public FormDetailView() 18 | { 19 | InitializeComponent(); 20 | } 21 | 22 | public void setListViewItem(ListViewItem listViewItem) 23 | { 24 | this.listViewItem = listViewItem; 25 | listViewColumn.Items[0].Selected = true; 26 | listViewColumn.Select(); 27 | } 28 | 29 | 30 | 31 | public void setAutoColumnSize() 32 | { 33 | listViewColumn.AutoResizeColumns(ColumnHeaderAutoResizeStyle.ColumnContent); 34 | listViewColumn.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize); 35 | } 36 | 37 | 38 | 39 | public void setColumnList(List columnInformationList) 40 | { 41 | columnInformationList.Sort(compareColumn); 42 | foreach (ColumnInformation columnInformation in columnInformationList) 43 | { 44 | listViewColumn.Items.Add(columnInformation.getName()); 45 | } 46 | setAutoColumnSize(); 47 | } 48 | 49 | public void setColumnList(List columnList) 50 | { 51 | foreach (Column column in columnList) 52 | { 53 | listViewColumn.Items.Add(column.getName()); 54 | } 55 | setAutoColumnSize(); 56 | } 57 | 58 | public int compareColumn(ColumnInformation x, ColumnInformation y) 59 | { 60 | if (x.getId() < y.getId()) 61 | { 62 | return -1; 63 | } 64 | else 65 | { 66 | return 0; 67 | } 68 | } 69 | 70 | private void listViewColumn_SelectedIndexChanged(object sender, EventArgs e) 71 | { 72 | if (listViewColumn.Items.Count == 0) 73 | return; 74 | if (listViewColumn.SelectedIndices.Count == 0) 75 | return; 76 | 77 | textBoxDetail.Text = this.listViewItem.SubItems[listViewColumn.SelectedIndices[0]+1].Text.ToString(); 78 | } 79 | 80 | protected override bool ProcessCmdKey(ref Message msg, Keys keyData) 81 | { 82 | if (keyData == (Keys.Escape)) 83 | { 84 | this.Close(); 85 | return true; 86 | } 87 | return base.ProcessCmdKey(ref msg, keyData); 88 | } 89 | } 90 | } 91 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/HexReader.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.IO; 6 | namespace IE10Analyzer 7 | { 8 | public class HexReader 9 | { 10 | String inputPath; 11 | FileStream fstream = null; 12 | BinaryReader br; 13 | public HexReader(String inputPath) 14 | { 15 | this.inputPath = inputPath; 16 | this.fstream = new FileStream(inputPath, FileMode.Open, FileAccess.Read, 17 | FileShare.ReadWrite); 18 | this.br = new BinaryReader(fstream); 19 | } 20 | 21 | public void close() 22 | { 23 | if (this.fstream != null) 24 | { 25 | this.fstream.Close(); 26 | this.fstream = null; 27 | } 28 | } 29 | 30 | public long getFileSize() 31 | { 32 | return fstream.Length; 33 | } 34 | 35 | public byte[] readByteDump(int offset, int len) 36 | { 37 | 38 | fstream.Seek(offset, SeekOrigin.Begin); 39 | //br.BaseStream.Seek(offset, ); 40 | return br.ReadBytes(len); 41 | } 42 | 43 | public String readString(int offset, int len) 44 | { 45 | byte[] bytes = readByteDump(offset, len); 46 | string str = Encoding.Default.GetString(bytes); 47 | return str; 48 | } 49 | 50 | public ushort readUshort(int offset) 51 | { 52 | byte[] bytes = readByteDump(offset, 2); 53 | ushort s = BitConverter.ToUInt16(bytes, 0); 54 | return s; 55 | } 56 | 57 | public short readShort(int offset) 58 | { 59 | byte[] bytes = readByteDump(offset, 2); 60 | short s = BitConverter.ToInt16(bytes, 0); 61 | return s; 62 | } 63 | 64 | public uint readUint(int offset) 65 | { 66 | byte[] bytes = readByteDump(offset, 4); 67 | uint i = BitConverter.ToUInt32(bytes, 0); 68 | return i; 69 | } 70 | 71 | public int readInt(int offset) 72 | { 73 | byte[] bytes = readByteDump(offset, 4); 74 | int i = BitConverter.ToInt32(bytes, 0); 75 | return i; 76 | } 77 | 78 | public int readIntBigEndian(int offset) 79 | { 80 | byte[] bytes = readByteDump(offset, 4); 81 | Array.Reverse(bytes); 82 | int i = BitConverter.ToInt32(bytes, 0); 83 | return i; 84 | } 85 | 86 | public ulong readUlong(int offset) 87 | { 88 | byte[] bytes = readByteDump(offset, 8); 89 | ulong l = BitConverter.ToUInt64(bytes, 0); 90 | return l; 91 | } 92 | 93 | public long readLong(int offset) 94 | { 95 | byte[] bytes = readByteDump(offset, 8); 96 | long l = BitConverter.ToInt64(bytes, 0); 97 | return l; 98 | } 99 | 100 | } 101 | } 102 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/SqlManager.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.IO; 6 | using System.Data.SQLite; 7 | using System.Windows.Forms; 8 | 9 | namespace IE10Analyzer 10 | { 11 | public class SqlManager 12 | { 13 | private String filePath = @".\ESEDATABASE.db"; 14 | 15 | SQLiteConnection m_dbConnection; 16 | public SqlManager(String filePath) 17 | { 18 | this.filePath = filePath; 19 | } 20 | 21 | public Boolean open() 22 | { 23 | /* 24 | if (File.Exists(filePath)) 25 | { 26 | MessageBox.Show("this file already exist"); 27 | return false; 28 | } 29 | * */ 30 | m_dbConnection = new SQLiteConnection("Data Source=" + filePath); 31 | m_dbConnection.Open(); 32 | return true; 33 | } 34 | 35 | public void close() 36 | { 37 | 38 | m_dbConnection.Close(); 39 | } 40 | 41 | public bool createTable(String tableName ,List columnsList) 42 | { 43 | 44 | int columnsCount = columnsList.Count; 45 | 46 | if(columnsCount ==0){ 47 | return false; 48 | } 49 | 50 | 51 | string sql = "CREATE TABLE IF NOT EXISTS " + tableName +" (" ; 52 | 53 | for(int i=0; i ColumnsList, List dataList){ 69 | tableName = tableName.Replace('(', '_').Replace(')', '_').Replace(':', '_'); 70 | if (createTable(tableName, ColumnsList)) 71 | { 72 | string sql = "INSERT INTO " + tableName + " ("; 73 | for (int i = 0; i < ColumnsList.Count - 1; i++) 74 | { 75 | sql += "_" + ColumnsList[i] + ", "; 76 | } 77 | sql += "_" + ColumnsList[ColumnsList.Count - 1] + ") VALUES ("; 78 | 79 | 80 | for (int i = 0; i < ColumnsList.Count - 1; i++) 81 | { 82 | sql += "@"+ i + ","; 83 | } 84 | sql += "@" + (ColumnsList.Count-1) + ")"; 85 | 86 | 87 | foreach (ListViewItem listViewItem in dataList) 88 | { 89 | SQLiteCommand insertSQL = new SQLiteCommand(sql, m_dbConnection); 90 | 91 | for (int i = 1; i < listViewItem.SubItems.Count; i++) 92 | { 93 | insertSQL.Parameters.Add(new SQLiteParameter("@" + (i-1), listViewItem.SubItems[i].Text)); 94 | } 95 | 96 | insertSQL.ExecuteNonQuery(); 97 | 98 | 99 | } 100 | return true; 101 | } 102 | else 103 | { 104 | return false; 105 | } 106 | 107 | } 108 | 109 | } 110 | } 111 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/DockTableList.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using WeifenLuo.WinFormsUI.Docking; 10 | 11 | namespace IE10Analyzer 12 | { 13 | public partial class DockTableList : DockContent 14 | { 15 | private FormMain formMain; 16 | 17 | public DockTableList(FormMain formMain) 18 | { 19 | InitializeComponent(); 20 | this.formMain = formMain; 21 | } 22 | 23 | public void clearList() 24 | { 25 | listViewTable.Items.Clear(); 26 | } 27 | 28 | public void selectTable(String tableName) 29 | { 30 | foreach (ListViewItem listViewItem in listViewTable.Items) 31 | { 32 | if (listViewItem.SubItems[1].Text.Equals(tableName)) 33 | { 34 | listViewItem.Selected = true; 35 | break; 36 | } 37 | } 38 | return; 39 | } 40 | public void setAutoColumnSize() 41 | { 42 | //listViewTable.AutoResizeColumns(ColumnHeaderAutoResizeStyle.ColumnContent); 43 | listViewTable.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize); 44 | listViewTable.Update(); 45 | } 46 | 47 | public List getTableList() 48 | { 49 | List listViewItemList = new List(); 50 | foreach (ListViewItem listViewItem in listViewTable.Items) 51 | { 52 | listViewItemList.Add(listViewItem); 53 | } 54 | return listViewItemList; 55 | } 56 | 57 | public void addItem(ListViewItem item) 58 | { 59 | listViewTable.Items.Add(item); 60 | } 61 | 62 | private void listViewTable_ColumnClick(object sender, ColumnClickEventArgs e) 63 | { 64 | // 방향 초기화 65 | for (int i = 0; i < listViewTable.Columns.Count; i++) 66 | { 67 | listViewTable.Columns[i].Text = listViewTable.Columns[i].Text.Replace(" △", ""); 68 | listViewTable.Columns[i].Text = listViewTable.Columns[i].Text.Replace(" ▽", ""); 69 | } 70 | 71 | // DESC 72 | if (this.listViewTable.Sorting == SortOrder.Ascending || listViewTable.Sorting == SortOrder.None) 73 | { 74 | this.listViewTable.ListViewItemSorter = new ListViewItemComparer(e.Column, "desc"); 75 | listViewTable.Sorting = SortOrder.Descending; 76 | listViewTable.Columns[e.Column].Text = listViewTable.Columns[e.Column].Text + " ▽"; 77 | } 78 | // ASC 79 | else 80 | { 81 | this.listViewTable.ListViewItemSorter = new ListViewItemComparer(e.Column, "asc"); 82 | listViewTable.Sorting = SortOrder.Ascending; 83 | listViewTable.Columns[e.Column].Text = listViewTable.Columns[e.Column].Text + " △"; 84 | } 85 | listViewTable.Sort(); 86 | } 87 | 88 | private void listViewTable_SelectedIndexChanged(object sender, EventArgs e) 89 | { 90 | if (listViewTable.Items.Count == 0) 91 | return; 92 | if (listViewTable.SelectedIndices.Count == 0) 93 | return; 94 | ListViewItem listViewItem = listViewTable.SelectedItems[0]; 95 | //ListViewItem listViewItem = listViewTable.Items[listViewTable.FocusedItem.Index]; 96 | 97 | 98 | formMain.selectTable(listViewItem.SubItems[0].Text, listViewItem); 99 | } 100 | } 101 | } 102 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormWait.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormWait 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormWait)); 32 | this.label = new System.Windows.Forms.Label(); 33 | this.progressBar = new System.Windows.Forms.ProgressBar(); 34 | this.backgroundWorker1 = new System.ComponentModel.BackgroundWorker(); 35 | this.labelPecentage = new System.Windows.Forms.Label(); 36 | this.SuspendLayout(); 37 | // 38 | // label 39 | // 40 | this.label.AutoSize = true; 41 | this.label.Location = new System.Drawing.Point(12, 11); 42 | this.label.Name = "label"; 43 | this.label.Size = new System.Drawing.Size(197, 12); 44 | this.label.TabIndex = 0; 45 | this.label.Text = "Please wait while loading records"; 46 | // 47 | // progressBar 48 | // 49 | this.progressBar.Location = new System.Drawing.Point(14, 37); 50 | this.progressBar.MarqueeAnimationSpeed = 150; 51 | this.progressBar.Name = "progressBar"; 52 | this.progressBar.Size = new System.Drawing.Size(418, 23); 53 | this.progressBar.TabIndex = 1; 54 | // 55 | // labelPecentage 56 | // 57 | this.labelPecentage.Anchor = System.Windows.Forms.AnchorStyles.Right; 58 | this.labelPecentage.Location = new System.Drawing.Point(332, 11); 59 | this.labelPecentage.Name = "labelPecentage"; 60 | this.labelPecentage.Size = new System.Drawing.Size(100, 12); 61 | this.labelPecentage.TabIndex = 2; 62 | this.labelPecentage.Text = "(0/0)"; 63 | this.labelPecentage.TextAlign = System.Drawing.ContentAlignment.MiddleRight; 64 | // 65 | // FormWait 66 | // 67 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 68 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 69 | this.ClientSize = new System.Drawing.Size(444, 76); 70 | this.Controls.Add(this.labelPecentage); 71 | this.Controls.Add(this.progressBar); 72 | this.Controls.Add(this.label); 73 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; 74 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 75 | this.MaximizeBox = false; 76 | this.MinimizeBox = false; 77 | this.Name = "FormWait"; 78 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 79 | this.Text = "Wait"; 80 | this.TopMost = true; 81 | this.ResumeLayout(false); 82 | this.PerformLayout(); 83 | 84 | } 85 | 86 | #endregion 87 | 88 | private System.Windows.Forms.Label label; 89 | private System.Windows.Forms.ProgressBar progressBar; 90 | private System.ComponentModel.BackgroundWorker backgroundWorker1; 91 | private System.Windows.Forms.Label labelPecentage; 92 | } 93 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // 이 코드는 도구를 사용하여 생성되었습니다. 4 | // 런타임 버전:4.0.30319.18063 5 | // 6 | // 파일 내용을 변경하면 잘못된 동작이 발생할 수 있으며, 코드를 다시 생성하면 7 | // 이러한 변경 내용이 손실됩니다. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace IEForensic.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// 지역화된 문자열 등을 찾기 위한 강력한 형식의 리소스 클래스입니다. 17 | /// 18 | // 이 클래스는 ResGen 또는 Visual Studio와 같은 도구를 통해 StronglyTypedResourceBuilder 19 | // 클래스에서 자동으로 생성되었습니다. 20 | // 멤버를 추가하거나 제거하려면 .ResX 파일을 편집한 다음 /str 옵션을 사용하여 ResGen을 21 | // 다시 실행하거나 VS 프로젝트를 다시 빌드하십시오. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | public class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// 이 클래스에서 사용하는 캐시된 ResourceManager 인스턴스를 반환합니다. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | public static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("IEForensic.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// 이 강력한 형식의 리소스 클래스를 사용하여 모든 리소스 조회에 대한 현재 스레드의 CurrentUICulture 51 | /// 속성을 재정의합니다. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | public static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | 63 | /// 64 | /// System.Byte[] 형식의 지역화된 리소스를 찾습니다. 65 | /// 66 | public static byte[] Esent_Interop { 67 | get { 68 | object obj = ResourceManager.GetObject("Esent_Interop", resourceCulture); 69 | return ((byte[])(obj)); 70 | } 71 | } 72 | 73 | /// 74 | /// System.Drawing.Bitmap 형식의 지역화된 리소스를 찾습니다. 75 | /// 76 | public static System.Drawing.Bitmap IE10Analyzer { 77 | get { 78 | object obj = ResourceManager.GetObject("IE10Analyzer", resourceCulture); 79 | return ((System.Drawing.Bitmap)(obj)); 80 | } 81 | } 82 | 83 | /// 84 | /// System.Byte[] 형식의 지역화된 리소스를 찾습니다. 85 | /// 86 | public static byte[] System_Data_SQLite { 87 | get { 88 | object obj = ResourceManager.GetObject("System_Data_SQLite", resourceCulture); 89 | return ((byte[])(obj)); 90 | } 91 | } 92 | 93 | /// 94 | /// System.Byte[] 형식의 지역화된 리소스를 찾습니다. 95 | /// 96 | public static byte[] WeifenLuo_WinFormsUI_Docking { 97 | get { 98 | object obj = ResourceManager.GetObject("WeifenLuo_WinFormsUI_Docking", resourceCulture); 99 | return ((byte[])(obj)); 100 | } 101 | } 102 | } 103 | } 104 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/About.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class About 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(About)); 32 | this.label1 = new System.Windows.Forms.Label(); 33 | this.label3 = new System.Windows.Forms.Label(); 34 | this.linkLabel1 = new System.Windows.Forms.LinkLabel(); 35 | this.pictureBox1 = new System.Windows.Forms.PictureBox(); 36 | ((System.ComponentModel.ISupportInitialize)(this.pictureBox1)).BeginInit(); 37 | this.SuspendLayout(); 38 | // 39 | // label1 40 | // 41 | this.label1.AutoSize = true; 42 | this.label1.Location = new System.Drawing.Point(76, 12); 43 | this.label1.Name = "label1"; 44 | this.label1.Size = new System.Drawing.Size(78, 12); 45 | this.label1.TabIndex = 1; 46 | this.label1.Text = "IE10Analyzer"; 47 | // 48 | // label3 49 | // 50 | this.label3.AutoSize = true; 51 | this.label3.Location = new System.Drawing.Point(76, 34); 52 | this.label3.Name = "label3"; 53 | this.label3.Size = new System.Drawing.Size(135, 12); 54 | this.label3.TabIndex = 3; 55 | this.label3.Text = "jh0314.kim@gmail.com"; 56 | // 57 | // linkLabel1 58 | // 59 | this.linkLabel1.AutoSize = true; 60 | this.linkLabel1.Location = new System.Drawing.Point(76, 55); 61 | this.linkLabel1.Name = "linkLabel1"; 62 | this.linkLabel1.Size = new System.Drawing.Size(178, 12); 63 | this.linkLabel1.TabIndex = 4; 64 | this.linkLabel1.TabStop = true; 65 | this.linkLabel1.Text = "http://moaistory.blogspot.com"; 66 | this.linkLabel1.LinkClicked += new System.Windows.Forms.LinkLabelLinkClickedEventHandler(this.linkLabel1_LinkClicked); 67 | // 68 | // pictureBox1 69 | // 70 | this.pictureBox1.Image = global::IEForensic.Properties.Resources.IE10Analyzer; 71 | this.pictureBox1.Location = new System.Drawing.Point(12, 12); 72 | this.pictureBox1.Name = "pictureBox1"; 73 | this.pictureBox1.Size = new System.Drawing.Size(58, 55); 74 | this.pictureBox1.SizeMode = System.Windows.Forms.PictureBoxSizeMode.Zoom; 75 | this.pictureBox1.TabIndex = 0; 76 | this.pictureBox1.TabStop = false; 77 | // 78 | // About 79 | // 80 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 81 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 82 | this.ClientSize = new System.Drawing.Size(365, 81); 83 | this.Controls.Add(this.linkLabel1); 84 | this.Controls.Add(this.label3); 85 | this.Controls.Add(this.label1); 86 | this.Controls.Add(this.pictureBox1); 87 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; 88 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 89 | this.MaximizeBox = false; 90 | this.MinimizeBox = false; 91 | this.Name = "About"; 92 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 93 | this.Text = "Information"; 94 | ((System.ComponentModel.ISupportInitialize)(this.pictureBox1)).EndInit(); 95 | this.ResumeLayout(false); 96 | this.PerformLayout(); 97 | 98 | } 99 | 100 | #endregion 101 | 102 | private System.Windows.Forms.PictureBox pictureBox1; 103 | private System.Windows.Forms.Label label1; 104 | private System.Windows.Forms.Label label3; 105 | private System.Windows.Forms.LinkLabel linkLabel1; 106 | } 107 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/DockTableList.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class DockTableList 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(DockTableList)); 32 | this.listViewTable = new System.Windows.Forms.ListView(); 33 | this.columnHeader = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 34 | this.columnHeaderTableName = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 35 | this.columnHeaderCount = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 36 | this.SuspendLayout(); 37 | // 38 | // listViewTable 39 | // 40 | this.listViewTable.BackColor = System.Drawing.SystemColors.Window; 41 | this.listViewTable.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { 42 | this.columnHeader, 43 | this.columnHeaderTableName, 44 | this.columnHeaderCount}); 45 | this.listViewTable.Dock = System.Windows.Forms.DockStyle.Fill; 46 | this.listViewTable.FullRowSelect = true; 47 | this.listViewTable.HideSelection = false; 48 | this.listViewTable.Location = new System.Drawing.Point(0, 0); 49 | this.listViewTable.MultiSelect = false; 50 | this.listViewTable.Name = "listViewTable"; 51 | this.listViewTable.Size = new System.Drawing.Size(184, 500); 52 | this.listViewTable.TabIndex = 0; 53 | this.listViewTable.UseCompatibleStateImageBehavior = false; 54 | this.listViewTable.View = System.Windows.Forms.View.Details; 55 | this.listViewTable.ColumnClick += new System.Windows.Forms.ColumnClickEventHandler(this.listViewTable_ColumnClick); 56 | this.listViewTable.SelectedIndexChanged += new System.EventHandler(this.listViewTable_SelectedIndexChanged); 57 | // 58 | // columnHeader 59 | // 60 | this.columnHeader.Tag = "Numeric"; 61 | this.columnHeader.Text = "No."; 62 | // 63 | // columnHeaderTableName 64 | // 65 | this.columnHeaderTableName.Tag = "Text"; 66 | this.columnHeaderTableName.Text = "Table Name"; 67 | this.columnHeaderTableName.Width = 254; 68 | // 69 | // columnHeaderCount 70 | // 71 | this.columnHeaderCount.Tag = "Numeric"; 72 | this.columnHeaderCount.Text = "Count"; 73 | this.columnHeaderCount.Width = 100; 74 | // 75 | // DockTableList 76 | // 77 | this.AllowEndUserDocking = false; 78 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Inherit; 79 | this.ClientSize = new System.Drawing.Size(184, 500); 80 | this.CloseButton = false; 81 | this.CloseButtonVisible = false; 82 | this.Controls.Add(this.listViewTable); 83 | this.DockAreas = WeifenLuo.WinFormsUI.Docking.DockAreas.DockLeft; 84 | this.Font = new System.Drawing.Font("굴림", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(129))); 85 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 86 | this.MaximizeBox = false; 87 | this.MinimizeBox = false; 88 | this.Name = "DockTableList"; 89 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 90 | this.Text = "Table"; 91 | this.ResumeLayout(false); 92 | 93 | } 94 | 95 | #endregion 96 | 97 | private System.Windows.Forms.ListView listViewTable; 98 | private System.Windows.Forms.ColumnHeader columnHeader; 99 | private System.Windows.Forms.ColumnHeader columnHeaderTableName; 100 | private System.Windows.Forms.ColumnHeader columnHeaderCount; 101 | } 102 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormInputUTCTime.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormInputUTCTime 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormInputUTCTime)); 32 | this.comboBoxUTCTime = new System.Windows.Forms.ComboBox(); 33 | this.label1 = new System.Windows.Forms.Label(); 34 | this.textBoxCountry = new System.Windows.Forms.TextBox(); 35 | this.buttonSave = new System.Windows.Forms.Button(); 36 | this.SuspendLayout(); 37 | // 38 | // comboBoxUTCTime 39 | // 40 | this.comboBoxUTCTime.DropDownStyle = System.Windows.Forms.ComboBoxStyle.DropDownList; 41 | this.comboBoxUTCTime.FormattingEnabled = true; 42 | this.comboBoxUTCTime.Location = new System.Drawing.Point(97, 6); 43 | this.comboBoxUTCTime.Name = "comboBoxUTCTime"; 44 | this.comboBoxUTCTime.Size = new System.Drawing.Size(230, 20); 45 | this.comboBoxUTCTime.TabIndex = 2; 46 | this.comboBoxUTCTime.SelectedValueChanged += new System.EventHandler(this.comboBoxUTCTime_SelectedValueChanged); 47 | // 48 | // label1 49 | // 50 | this.label1.AutoSize = true; 51 | this.label1.Location = new System.Drawing.Point(5, 10); 52 | this.label1.Name = "label1"; 53 | this.label1.Size = new System.Drawing.Size(86, 12); 54 | this.label1.TabIndex = 3; 55 | this.label1.Text = "Time Zones : "; 56 | // 57 | // textBoxCountry 58 | // 59 | this.textBoxCountry.Location = new System.Drawing.Point(13, 38); 60 | this.textBoxCountry.Multiline = true; 61 | this.textBoxCountry.Name = "textBoxCountry"; 62 | this.textBoxCountry.ReadOnly = true; 63 | this.textBoxCountry.ScrollBars = System.Windows.Forms.ScrollBars.Vertical; 64 | this.textBoxCountry.Size = new System.Drawing.Size(314, 109); 65 | this.textBoxCountry.TabIndex = 4; 66 | // 67 | // buttonSave 68 | // 69 | this.buttonSave.DialogResult = System.Windows.Forms.DialogResult.Cancel; 70 | this.buttonSave.Location = new System.Drawing.Point(252, 153); 71 | this.buttonSave.Name = "buttonSave"; 72 | this.buttonSave.Size = new System.Drawing.Size(75, 23); 73 | this.buttonSave.TabIndex = 5; 74 | this.buttonSave.Text = "Save"; 75 | this.buttonSave.UseVisualStyleBackColor = true; 76 | this.buttonSave.Click += new System.EventHandler(this.buttonSave_Click); 77 | // 78 | // FormInputUTCTime 79 | // 80 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 81 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 82 | this.CancelButton = this.buttonSave; 83 | this.ClientSize = new System.Drawing.Size(339, 188); 84 | this.Controls.Add(this.buttonSave); 85 | this.Controls.Add(this.textBoxCountry); 86 | this.Controls.Add(this.label1); 87 | this.Controls.Add(this.comboBoxUTCTime); 88 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; 89 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 90 | this.MaximizeBox = false; 91 | this.MinimizeBox = false; 92 | this.Name = "FormInputUTCTime"; 93 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 94 | this.Text = "UTC Time"; 95 | this.TopMost = true; 96 | this.FormClosed += new System.Windows.Forms.FormClosedEventHandler(this.FormInputUTCTime_FormClosed); 97 | this.ResumeLayout(false); 98 | this.PerformLayout(); 99 | 100 | } 101 | 102 | #endregion 103 | 104 | private System.Windows.Forms.ComboBox comboBoxUTCTime; 105 | private System.Windows.Forms.Label label1; 106 | private System.Windows.Forms.TextBox textBoxCountry; 107 | private System.Windows.Forms.Button buttonSave; 108 | } 109 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/MSysObjects.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Windows.Forms; 6 | 7 | namespace IE10Analyzer.EDBParser 8 | { 9 | public class MSysObjects 10 | { 11 | private Table tableMsysObject; 12 | private HexReader hexReader; 13 | private int pagesize; 14 | private Dictionary tableDict; 15 | private Dictionary lvTableDict; 16 | private String UTCAddHour = "0"; 17 | private String UTCAddMinute = "0"; 18 | private Table containersTable; 19 | public MSysObjects(HexReader hexReader, int pagesize){ 20 | this.pagesize = pagesize; 21 | this.tableMsysObject = null; 22 | this.hexReader = hexReader; 23 | this.tableDict = new Dictionary(); 24 | this.lvTableDict = new Dictionary(); 25 | } 26 | 27 | public void setMSysObjectColumns(){ 28 | this.tableMsysObject.addColumn(new Column(1, 4, 4, "ObjidTable")); 29 | this.tableMsysObject.addColumn(new Column(2, 3, 2, "Type")); 30 | this.tableMsysObject.addColumn(new Column(3, 4, 4, "Id")); 31 | this.tableMsysObject.addColumn(new Column(4, 4, 4, "ColtypOrPgnoFDP")); 32 | this.tableMsysObject.addColumn(new Column(5, 4, 4, "SpaceUsage")); 33 | this.tableMsysObject.addColumn(new Column(6, 4, 4, "Flags")); 34 | this.tableMsysObject.addColumn(new Column(7, 4, 4, "PagesOrLocale")); 35 | this.tableMsysObject.addColumn(new Column(8, 1, 1, "RootFlag")); 36 | this.tableMsysObject.addColumn(new Column(9, 3, 2, "RecordOffset")); 37 | this.tableMsysObject.addColumn(new Column(10, 4, 4, "LCMapFlags")); 38 | this.tableMsysObject.addColumn(new Column(11, 17, 2, "KeyMost")); 39 | this.tableMsysObject.addColumn(new Column(128, 10, 255, "Name")); 40 | this.tableMsysObject.addColumn(new Column(129, 9, 255, "Stats")); 41 | this.tableMsysObject.addColumn(new Column(130, 10, 255, "TemplateTable")); 42 | this.tableMsysObject.addColumn(new Column(131, 9, 255, "DefaultValue")); 43 | this.tableMsysObject.addColumn(new Column(132, 9, 255, "KeyFldIDs")); 44 | } 45 | 46 | public void makeTables() 47 | { 48 | this.tableMsysObject = new Table(this.hexReader, this.pagesize, "MsysObject", 2, 4); 49 | this.tableMsysObject.setUTCTime(UTCAddHour, UTCAddMinute); 50 | this.setMSysObjectColumns(); 51 | this.tableMsysObject.init(); 52 | List> recordList = this.tableMsysObject.parseRecord(); 53 | 54 | foreach(Dictionary record in recordList){ 55 | int objidTable = Int32.Parse(record[1].getValue()); 56 | short type = Int16.Parse(record[2].getValue()); 57 | int id = Int32.Parse(record[3].getValue()); 58 | int coltypOrPgnoFDP = Int32.Parse(record[4].getValue()); 59 | int spaceUsage = Int32.Parse(record[5].getValue()); 60 | string name = record[128].getValue().Replace("\0", string.Empty); 61 | 62 | if(type==1){ 63 | if(!this.tableDict.ContainsKey(objidTable)){ //table가 존재하지 않음 64 | Table table = new Table(this.hexReader, this.pagesize, name, id, coltypOrPgnoFDP); 65 | table.setUTCTime(UTCAddHour, UTCAddMinute); 66 | table.init(); 67 | if (table.getTableName().Equals("Containers")) 68 | { 69 | this.containersTable = table; 70 | } 71 | 72 | 73 | this.tableDict.Add(id, table); 74 | } 75 | }else if(type==2){ 76 | Column column = new Column(id, coltypOrPgnoFDP, spaceUsage, name); 77 | if(objidTable == 2){ //MSysObject Table 78 | this.tableMsysObject.addColumn(column); 79 | } 80 | this.tableDict[objidTable].addColumn(column); 81 | }else if(type==4){ 82 | if(this.tableDict.ContainsKey(objidTable)){ 83 | this.tableDict[objidTable].setLongValueNumber(id); 84 | } 85 | Table lvTable = new Table(this.hexReader, this.pagesize, name, id, coltypOrPgnoFDP); 86 | lvTable.setUTCTime(UTCAddHour, UTCAddMinute); 87 | lvTable.init(); 88 | this.lvTableDict.Add(id, lvTable); 89 | } 90 | } 91 | return; 92 | } 93 | 94 | public Dictionary getTableDict(){ 95 | return this.tableDict; 96 | } 97 | 98 | public Dictionary getLvTableDict(){ 99 | return this.lvTableDict; 100 | } 101 | 102 | public void setUTCTime(String UTCAddHour, String UTCAddMinute) 103 | { 104 | this.UTCAddHour = UTCAddHour; 105 | this.UTCAddMinute = UTCAddMinute; 106 | } 107 | 108 | public Table getContainersTable() 109 | { 110 | return this.containersTable; 111 | } 112 | 113 | public void recoveryDeletedTable() 114 | { 115 | this.tableMsysObject.recoverRecord(); 116 | } 117 | } 118 | } 119 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormDetailView.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormDetailView 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormDetailView)); 32 | this.splitContainer1 = new System.Windows.Forms.SplitContainer(); 33 | this.listViewColumn = new System.Windows.Forms.ListView(); 34 | this.columnName = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 35 | this.textBoxDetail = new System.Windows.Forms.TextBox(); 36 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer1)).BeginInit(); 37 | this.splitContainer1.Panel1.SuspendLayout(); 38 | this.splitContainer1.Panel2.SuspendLayout(); 39 | this.splitContainer1.SuspendLayout(); 40 | this.SuspendLayout(); 41 | // 42 | // splitContainer1 43 | // 44 | this.splitContainer1.Dock = System.Windows.Forms.DockStyle.Fill; 45 | this.splitContainer1.FixedPanel = System.Windows.Forms.FixedPanel.Panel1; 46 | this.splitContainer1.IsSplitterFixed = true; 47 | this.splitContainer1.Location = new System.Drawing.Point(0, 0); 48 | this.splitContainer1.Name = "splitContainer1"; 49 | // 50 | // splitContainer1.Panel1 51 | // 52 | this.splitContainer1.Panel1.Controls.Add(this.listViewColumn); 53 | // 54 | // splitContainer1.Panel2 55 | // 56 | this.splitContainer1.Panel2.Controls.Add(this.textBoxDetail); 57 | this.splitContainer1.Size = new System.Drawing.Size(584, 562); 58 | this.splitContainer1.SplitterDistance = 194; 59 | this.splitContainer1.TabIndex = 0; 60 | // 61 | // listViewColumn 62 | // 63 | this.listViewColumn.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { 64 | this.columnName}); 65 | this.listViewColumn.Dock = System.Windows.Forms.DockStyle.Fill; 66 | this.listViewColumn.FullRowSelect = true; 67 | this.listViewColumn.HideSelection = false; 68 | this.listViewColumn.Location = new System.Drawing.Point(0, 0); 69 | this.listViewColumn.MultiSelect = false; 70 | this.listViewColumn.Name = "listViewColumn"; 71 | this.listViewColumn.Size = new System.Drawing.Size(194, 562); 72 | this.listViewColumn.TabIndex = 0; 73 | this.listViewColumn.UseCompatibleStateImageBehavior = false; 74 | this.listViewColumn.View = System.Windows.Forms.View.Details; 75 | this.listViewColumn.SelectedIndexChanged += new System.EventHandler(this.listViewColumn_SelectedIndexChanged); 76 | // 77 | // columnName 78 | // 79 | this.columnName.Text = "Column Name"; 80 | // 81 | // textBoxDetail 82 | // 83 | this.textBoxDetail.BackColor = System.Drawing.SystemColors.ButtonHighlight; 84 | this.textBoxDetail.Dock = System.Windows.Forms.DockStyle.Fill; 85 | this.textBoxDetail.Location = new System.Drawing.Point(0, 0); 86 | this.textBoxDetail.Multiline = true; 87 | this.textBoxDetail.Name = "textBoxDetail"; 88 | this.textBoxDetail.ReadOnly = true; 89 | this.textBoxDetail.ScrollBars = System.Windows.Forms.ScrollBars.Vertical; 90 | this.textBoxDetail.Size = new System.Drawing.Size(386, 562); 91 | this.textBoxDetail.TabIndex = 0; 92 | // 93 | // FormDetailView 94 | // 95 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 96 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 97 | this.ClientSize = new System.Drawing.Size(584, 562); 98 | this.Controls.Add(this.splitContainer1); 99 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 100 | this.Name = "FormDetailView"; 101 | this.Text = "Detail View"; 102 | this.splitContainer1.Panel1.ResumeLayout(false); 103 | this.splitContainer1.Panel2.ResumeLayout(false); 104 | this.splitContainer1.Panel2.PerformLayout(); 105 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer1)).EndInit(); 106 | this.splitContainer1.ResumeLayout(false); 107 | this.ResumeLayout(false); 108 | 109 | } 110 | 111 | #endregion 112 | 113 | private System.Windows.Forms.SplitContainer splitContainer1; 114 | private System.Windows.Forms.ListView listViewColumn; 115 | private System.Windows.Forms.TextBox textBoxDetail; 116 | private System.Windows.Forms.ColumnHeader columnName; 117 | } 118 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormSave.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormSave 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormSave)); 32 | this.buttonSave = new System.Windows.Forms.Button(); 33 | this.listViewTable = new System.Windows.Forms.ListView(); 34 | this.columnHeaderNumber = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 35 | this.columnHeaderTableName = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 36 | this.columnHeaderCount = ((System.Windows.Forms.ColumnHeader)(new System.Windows.Forms.ColumnHeader())); 37 | this.buttonCancle = new System.Windows.Forms.Button(); 38 | this.buttonCheckAll = new System.Windows.Forms.Button(); 39 | this.buttonUnCheck = new System.Windows.Forms.Button(); 40 | this.SuspendLayout(); 41 | // 42 | // buttonSave 43 | // 44 | this.buttonSave.Location = new System.Drawing.Point(395, 9); 45 | this.buttonSave.Name = "buttonSave"; 46 | this.buttonSave.Size = new System.Drawing.Size(85, 23); 47 | this.buttonSave.TabIndex = 0; 48 | this.buttonSave.Text = "Save"; 49 | this.buttonSave.UseVisualStyleBackColor = true; 50 | this.buttonSave.Click += new System.EventHandler(this.buttonSave_Click); 51 | // 52 | // listViewTable 53 | // 54 | this.listViewTable.CheckBoxes = true; 55 | this.listViewTable.Columns.AddRange(new System.Windows.Forms.ColumnHeader[] { 56 | this.columnHeaderNumber, 57 | this.columnHeaderTableName, 58 | this.columnHeaderCount}); 59 | this.listViewTable.FullRowSelect = true; 60 | this.listViewTable.Location = new System.Drawing.Point(9, 12); 61 | this.listViewTable.Name = "listViewTable"; 62 | this.listViewTable.Size = new System.Drawing.Size(367, 438); 63 | this.listViewTable.TabIndex = 1; 64 | this.listViewTable.UseCompatibleStateImageBehavior = false; 65 | this.listViewTable.View = System.Windows.Forms.View.Details; 66 | this.listViewTable.ColumnClick += new System.Windows.Forms.ColumnClickEventHandler(this.listViewTable_ColumnClick); 67 | // 68 | // columnHeaderNumber 69 | // 70 | this.columnHeaderNumber.Tag = "Numeric"; 71 | this.columnHeaderNumber.Text = "No."; 72 | // 73 | // columnHeaderTableName 74 | // 75 | this.columnHeaderTableName.Tag = "Text"; 76 | this.columnHeaderTableName.Text = "Table Name"; 77 | this.columnHeaderTableName.Width = 227; 78 | // 79 | // columnHeaderCount 80 | // 81 | this.columnHeaderCount.Tag = "Numeric"; 82 | this.columnHeaderCount.Text = "Count"; 83 | this.columnHeaderCount.Width = 80; 84 | // 85 | // buttonCancle 86 | // 87 | this.buttonCancle.Location = new System.Drawing.Point(395, 41); 88 | this.buttonCancle.Name = "buttonCancle"; 89 | this.buttonCancle.Size = new System.Drawing.Size(86, 23); 90 | this.buttonCancle.TabIndex = 2; 91 | this.buttonCancle.Text = "Cancle"; 92 | this.buttonCancle.UseVisualStyleBackColor = true; 93 | this.buttonCancle.Click += new System.EventHandler(this.buttonCancle_Click); 94 | // 95 | // buttonCheckAll 96 | // 97 | this.buttonCheckAll.Location = new System.Drawing.Point(395, 93); 98 | this.buttonCheckAll.Name = "buttonCheckAll"; 99 | this.buttonCheckAll.Size = new System.Drawing.Size(85, 23); 100 | this.buttonCheckAll.TabIndex = 3; 101 | this.buttonCheckAll.Text = "Check All"; 102 | this.buttonCheckAll.UseVisualStyleBackColor = true; 103 | this.buttonCheckAll.Click += new System.EventHandler(this.buttonCheckAll_Click); 104 | // 105 | // buttonUnCheck 106 | // 107 | this.buttonUnCheck.Location = new System.Drawing.Point(395, 124); 108 | this.buttonUnCheck.Name = "buttonUnCheck"; 109 | this.buttonUnCheck.Size = new System.Drawing.Size(84, 23); 110 | this.buttonUnCheck.TabIndex = 4; 111 | this.buttonUnCheck.Text = "Uncheck"; 112 | this.buttonUnCheck.UseVisualStyleBackColor = true; 113 | this.buttonUnCheck.Click += new System.EventHandler(this.buttonUnCheck_Click); 114 | // 115 | // FormSave 116 | // 117 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 118 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 119 | this.ClientSize = new System.Drawing.Size(491, 462); 120 | this.Controls.Add(this.buttonUnCheck); 121 | this.Controls.Add(this.buttonCheckAll); 122 | this.Controls.Add(this.buttonCancle); 123 | this.Controls.Add(this.listViewTable); 124 | this.Controls.Add(this.buttonSave); 125 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; 126 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 127 | this.MaximizeBox = false; 128 | this.MinimizeBox = false; 129 | this.Name = "FormSave"; 130 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 131 | this.Text = "Save As..."; 132 | this.ResumeLayout(false); 133 | 134 | } 135 | 136 | #endregion 137 | 138 | private System.Windows.Forms.Button buttonSave; 139 | private System.Windows.Forms.ListView listViewTable; 140 | private System.Windows.Forms.Button buttonCancle; 141 | private System.Windows.Forms.ColumnHeader columnHeaderNumber; 142 | private System.Windows.Forms.ColumnHeader columnHeaderTableName; 143 | private System.Windows.Forms.ColumnHeader columnHeaderCount; 144 | private System.Windows.Forms.Button buttonCheckAll; 145 | private System.Windows.Forms.Button buttonUnCheck; 146 | } 147 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/DockRecordList.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class DockRecordList 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | this.components = new System.ComponentModel.Container(); 32 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(DockRecordList)); 33 | this.listViewData = new System.Windows.Forms.ListView(); 34 | this.contextMenuStrip = new System.Windows.Forms.ContextMenuStrip(this.components); 35 | this.checkToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 36 | this.viewToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 37 | this.checkedReocrdsToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 38 | this.allRecordsToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 39 | this.exportToCSVToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 40 | this.checkedRecordsToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 41 | this.allRecordsToolStripMenuItem1 = new System.Windows.Forms.ToolStripMenuItem(); 42 | this.contextMenuStrip.SuspendLayout(); 43 | this.SuspendLayout(); 44 | // 45 | // listViewData 46 | // 47 | this.listViewData.CheckBoxes = true; 48 | this.listViewData.Dock = System.Windows.Forms.DockStyle.Fill; 49 | this.listViewData.FullRowSelect = true; 50 | this.listViewData.Location = new System.Drawing.Point(0, 0); 51 | this.listViewData.MultiSelect = false; 52 | this.listViewData.Name = "listViewData"; 53 | this.listViewData.Size = new System.Drawing.Size(564, 500); 54 | this.listViewData.TabIndex = 0; 55 | this.listViewData.UseCompatibleStateImageBehavior = false; 56 | this.listViewData.View = System.Windows.Forms.View.Details; 57 | this.listViewData.ColumnClick += new System.Windows.Forms.ColumnClickEventHandler(this.listViewData_ColumnClick); 58 | this.listViewData.MouseClick += new System.Windows.Forms.MouseEventHandler(this.listViewData_MouseClick); 59 | this.listViewData.MouseDoubleClick += new System.Windows.Forms.MouseEventHandler(this.listViewData_MouseDoubleClick); 60 | this.listViewData.MouseDown += new System.Windows.Forms.MouseEventHandler(this.listViewData_MouseDown); 61 | // 62 | // contextMenuStrip 63 | // 64 | this.contextMenuStrip.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { 65 | this.checkToolStripMenuItem, 66 | this.viewToolStripMenuItem, 67 | this.exportToCSVToolStripMenuItem}); 68 | this.contextMenuStrip.Name = "contextMenuStrip"; 69 | this.contextMenuStrip.Size = new System.Drawing.Size(153, 92); 70 | // 71 | // checkToolStripMenuItem 72 | // 73 | this.checkToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("checkToolStripMenuItem.Image"))); 74 | this.checkToolStripMenuItem.Name = "checkToolStripMenuItem"; 75 | this.checkToolStripMenuItem.Size = new System.Drawing.Size(152, 22); 76 | this.checkToolStripMenuItem.Text = "Check"; 77 | this.checkToolStripMenuItem.Click += new System.EventHandler(this.checkToolStripMenuItem_Click); 78 | // 79 | // viewToolStripMenuItem 80 | // 81 | this.viewToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 82 | this.checkedReocrdsToolStripMenuItem, 83 | this.allRecordsToolStripMenuItem}); 84 | this.viewToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("viewToolStripMenuItem.Image"))); 85 | this.viewToolStripMenuItem.Name = "viewToolStripMenuItem"; 86 | this.viewToolStripMenuItem.Size = new System.Drawing.Size(152, 22); 87 | this.viewToolStripMenuItem.Text = "View"; 88 | // 89 | // checkedReocrdsToolStripMenuItem 90 | // 91 | this.checkedReocrdsToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("checkedReocrdsToolStripMenuItem.Image"))); 92 | this.checkedReocrdsToolStripMenuItem.Name = "checkedReocrdsToolStripMenuItem"; 93 | this.checkedReocrdsToolStripMenuItem.Size = new System.Drawing.Size(163, 22); 94 | this.checkedReocrdsToolStripMenuItem.Text = "Checked reocrds"; 95 | this.checkedReocrdsToolStripMenuItem.Click += new System.EventHandler(this.checkedReocrdsToolStripMenuItem_Click); 96 | // 97 | // allRecordsToolStripMenuItem 98 | // 99 | this.allRecordsToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("allRecordsToolStripMenuItem.Image"))); 100 | this.allRecordsToolStripMenuItem.Name = "allRecordsToolStripMenuItem"; 101 | this.allRecordsToolStripMenuItem.Size = new System.Drawing.Size(163, 22); 102 | this.allRecordsToolStripMenuItem.Text = "All records"; 103 | this.allRecordsToolStripMenuItem.Click += new System.EventHandler(this.allRecordsToolStripMenuItem_Click); 104 | // 105 | // exportToCSVToolStripMenuItem 106 | // 107 | this.exportToCSVToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 108 | this.checkedRecordsToolStripMenuItem, 109 | this.allRecordsToolStripMenuItem1}); 110 | this.exportToCSVToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("exportToCSVToolStripMenuItem.Image"))); 111 | this.exportToCSVToolStripMenuItem.Name = "exportToCSVToolStripMenuItem"; 112 | this.exportToCSVToolStripMenuItem.Size = new System.Drawing.Size(152, 22); 113 | this.exportToCSVToolStripMenuItem.Text = "Export to CSV"; 114 | // 115 | // checkedRecordsToolStripMenuItem 116 | // 117 | this.checkedRecordsToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("checkedRecordsToolStripMenuItem.Image"))); 118 | this.checkedRecordsToolStripMenuItem.Name = "checkedRecordsToolStripMenuItem"; 119 | this.checkedRecordsToolStripMenuItem.Size = new System.Drawing.Size(163, 22); 120 | this.checkedRecordsToolStripMenuItem.Text = "Checked records"; 121 | this.checkedRecordsToolStripMenuItem.Click += new System.EventHandler(this.checkedRecordsToolStripMenuItem_Click); 122 | // 123 | // allRecordsToolStripMenuItem1 124 | // 125 | this.allRecordsToolStripMenuItem1.Image = ((System.Drawing.Image)(resources.GetObject("allRecordsToolStripMenuItem1.Image"))); 126 | this.allRecordsToolStripMenuItem1.Name = "allRecordsToolStripMenuItem1"; 127 | this.allRecordsToolStripMenuItem1.Size = new System.Drawing.Size(163, 22); 128 | this.allRecordsToolStripMenuItem1.Text = "All records"; 129 | this.allRecordsToolStripMenuItem1.Click += new System.EventHandler(this.allRecordsToolStripMenuItem1_Click); 130 | // 131 | // DockRecordList 132 | // 133 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 134 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 135 | this.ClientSize = new System.Drawing.Size(564, 500); 136 | this.Controls.Add(this.listViewData); 137 | this.Font = new System.Drawing.Font("굴림", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(129))); 138 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 139 | this.MaximizeBox = false; 140 | this.MinimizeBox = false; 141 | this.Name = "DockRecordList"; 142 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen; 143 | this.Text = "Data"; 144 | this.contextMenuStrip.ResumeLayout(false); 145 | this.ResumeLayout(false); 146 | 147 | } 148 | 149 | #endregion 150 | 151 | private System.Windows.Forms.ListView listViewData; 152 | private System.Windows.Forms.ContextMenuStrip contextMenuStrip; 153 | private System.Windows.Forms.ToolStripMenuItem viewToolStripMenuItem; 154 | private System.Windows.Forms.ToolStripMenuItem checkedReocrdsToolStripMenuItem; 155 | private System.Windows.Forms.ToolStripMenuItem allRecordsToolStripMenuItem; 156 | private System.Windows.Forms.ToolStripMenuItem exportToCSVToolStripMenuItem; 157 | private System.Windows.Forms.ToolStripMenuItem checkToolStripMenuItem; 158 | private System.Windows.Forms.ToolStripMenuItem checkedRecordsToolStripMenuItem; 159 | private System.Windows.Forms.ToolStripMenuItem allRecordsToolStripMenuItem1; 160 | } 161 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/EDBParser/Item.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Windows.Forms; 6 | 7 | namespace IE10Analyzer.EDBParser 8 | { 9 | public class Item 10 | { 11 | private int offset; 12 | private int size; 13 | private int id; 14 | private int maxLength; 15 | private string columnName; 16 | private ColType.TYPE type; 17 | private byte taggedDataItemFlag; 18 | private HexReader hexReader; 19 | private string UTCAddHour; 20 | private string UTCAddMinute; 21 | public Item() { } 22 | 23 | 24 | public Item(HexReader hexReader, int id, string columnName, ColType.TYPE type, int maxLength, int offset, int size) 25 | { 26 | this.hexReader = hexReader; 27 | this.id = id; 28 | this.columnName = columnName; 29 | this.offset = offset; 30 | this.size = size; 31 | this.maxLength = maxLength; 32 | this.type = type; 33 | if (this.id >= 0x100) 34 | { 35 | this.taggedDataItemFlag = hexReader.readByteDump(offset, 1)[0]; 36 | this.offset++; 37 | this.size--; 38 | } 39 | else 40 | { 41 | this.taggedDataItemFlag = 0; 42 | } 43 | } 44 | 45 | public void UTCTime(string UTCAddHour, string UTCAddMinute) 46 | { 47 | this.UTCAddHour = UTCAddHour; 48 | this.UTCAddMinute = UTCAddMinute; 49 | } 50 | 51 | public int getID() 52 | { 53 | return this.id; 54 | } 55 | 56 | public ColType.TYPE getType() 57 | { 58 | return this.type; 59 | } 60 | 61 | 62 | public byte getTaggedDataItemFlag() 63 | { 64 | return this.taggedDataItemFlag; 65 | } 66 | 67 | public int getSize() 68 | { 69 | return this.size; 70 | } 71 | 72 | public void setIdType(int id, ColType.TYPE type) 73 | { 74 | this.id = id; 75 | this.type = type; 76 | } 77 | 78 | public int getPointNumber() 79 | { 80 | Byte[] data = hexReader.readByteDump(offset, 4); 81 | return BitConverter.ToInt32(data, 0); 82 | } 83 | 84 | public string getValue() 85 | { 86 | try 87 | { 88 | Byte[] data = hexReader.readByteDump(offset, size); 89 | 90 | if (columnName.Contains("Time")) 91 | { 92 | try 93 | { 94 | long timeValue = (long)BitConverter.ToUInt64(data, 0); 95 | if (timeValue == 0) 96 | { 97 | return "0"; 98 | } 99 | DateTime datetime = DateTime.FromBinary(timeValue); 100 | datetime = datetime.AddYears(1600); 101 | datetime = datetime.AddHours(Int32.Parse(UTCAddHour)); 102 | datetime = datetime.AddMinutes(Int32.Parse(UTCAddMinute)); 103 | return datetime.ToString("yyyy-MM-dd HH:mm:ss"); 104 | } 105 | catch 106 | { 107 | return "0"; 108 | } 109 | } 110 | 111 | if (this.type == ColType.TYPE.JET_coltypNil) //bool 112 | { 113 | return "NULL"; 114 | } 115 | else if (this.type == ColType.TYPE.JET_coltypBit) //bool 116 | { 117 | return data[0] == 1 ? "TRUE" : "FALSE"; 118 | } 119 | else if (this.type == ColType.TYPE.JET_coltypUnsignedByte) //byte 120 | { 121 | return data[0].ToString(); 122 | } 123 | else if (this.type == ColType.TYPE.JET_coltypShort) //short 124 | { 125 | return BitConverter.ToInt16(data, 0).ToString(); 126 | } 127 | else if (this.type == ColType.TYPE.JET_coltypLong) //integer 128 | { 129 | return BitConverter.ToInt32(data, 0).ToString(); 130 | } 131 | else if (this.type == ColType.TYPE.JET_coltypCurrency) //binary 132 | { 133 | double temp = (double)BitConverter.ToInt64(data, 0) / 1E4; 134 | return temp.ToString(); 135 | } 136 | else if (this.type == ColType.TYPE.JET_coltypIEEESingle) //float 137 | { 138 | return BitConverter.ToSingle(data, 0).ToString(); 139 | } 140 | else if (this.type == ColType.TYPE.JET_coltypIEEEDouble) //double 141 | { 142 | return BitConverter.ToDouble(data, 0).ToString(); 143 | } 144 | else if (this.type == ColType.TYPE.JET_coltypDateTime) //dateTime 145 | { 146 | long longVar = BitConverter.ToInt64(data, 0); 147 | DateTime dateTimeVar = new DateTime(1980, 1, 1).AddMilliseconds(longVar); 148 | dateTimeVar.AddHours((Double)Int32.Parse(UTCAddHour)); 149 | dateTimeVar.AddMinutes((Double)Int32.Parse(UTCAddMinute)); 150 | return dateTimeVar.ToString(); 151 | } 152 | else if (this.type == ColType.TYPE.JET_coltypBinary) //binary 153 | { 154 | string hex = BitConverter.ToString(data); 155 | return hex.Replace("-", ""); 156 | } 157 | else if (this.type == ColType.TYPE.JET_coltypText) //text 158 | { 159 | if (maxLength == 255) 160 | { 161 | return Encoding.UTF8.GetString(data); 162 | } 163 | else 164 | { 165 | return Encoding.Unicode.GetString(data); 166 | } 167 | } 168 | else if (this.type == ColType.TYPE.JET_coltypLongBinary) //binary 169 | { 170 | string hex = BitConverter.ToString(data); 171 | return hex.Replace("-", ""); 172 | } 173 | else if (this.type == ColType.TYPE.JET_coltypLongText) //text 174 | { 175 | return Encoding.Unicode.GetString(data); 176 | } 177 | else if (this.type == ColType.TYPE.JET_coltypSLV) //integer 178 | { 179 | return BitConverter.ToInt32(data, 0).ToString(); 180 | } 181 | else if (this.type == ColType.TYPE.JET_coltypUnsignedLong) //unsigned integer 182 | { 183 | return BitConverter.ToUInt32(data, 0).ToString(); 184 | } 185 | else if (this.type == ColType.TYPE.JET_coltypLongLong) //unsigned long long 186 | { 187 | return BitConverter.ToUInt64(data, 0).ToString(); 188 | } 189 | else if (this.type == ColType.TYPE.JET_coltypGUID) //text 190 | { 191 | return Encoding.UTF8.GetString(data); 192 | } 193 | else if (this.type == ColType.TYPE.JET_coltypUnsignedShort) //unsigned short 194 | { 195 | return BitConverter.ToInt16(data, 0).ToString(); 196 | } 197 | else 198 | { 199 | return "UNKNOWN"; 200 | } 201 | } 202 | catch (Exception ex) 203 | { 204 | MessageBox.Show("Error : " + ex.Message.ToString() + "\r\noffset : " + offset, "Parsing Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 205 | return "Parsing Error : (Offset : " + offset + ")"; 206 | } 207 | } 208 | 209 | private string ByteToBitStream(byte value){ 210 | string buffer = ""; 211 | buffer += (value & 0x80)!= 0 ? '1':'0'; 212 | buffer += (value & 0x40)!= 0 ? '1':'0'; 213 | buffer += (value & 0x20)!= 0 ? '1':'0'; 214 | buffer += (value & 0x10)!= 0 ? '1':'0'; 215 | buffer += (value & 0x08)!= 0 ? '1':'0'; 216 | buffer += (value & 0x04)!= 0 ? '1':'0'; 217 | buffer += (value & 0x02)!= 0 ? '1':'0'; 218 | buffer += (value & 0x01)!= 0 ? '1':'0'; 219 | return buffer; 220 | } 221 | private byte BitStreamToByte(string value){ 222 | int toShift = 0; 223 | char[] buffer = value.ToCharArray(); 224 | int size = value.Length; 225 | for(int i = 0; i < size; i++) { 226 | toShift = (toShift << 1); 227 | if(buffer[i] == '1') { 228 | toShift++; 229 | } 230 | } 231 | return (byte)toShift; 232 | } 233 | 234 | 235 | public string getDecompressText() 236 | { 237 | List data = new List(); 238 | string temp1 = ""; 239 | string temp2 = ""; 240 | 241 | byte byteValue = 0; 242 | for (int i = 1; i < this.size; i++) 243 | { 244 | byteValue = this.hexReader.readByteDump(offset + i,1)[0]; 245 | temp2 = ByteToBitStream(byteValue); 246 | for (int j = temp2.Length; j < 8; j++) 247 | { 248 | temp2 = '0' + temp2; 249 | } 250 | temp1 = temp2 + temp1; 251 | while (temp1.Length >= 7) 252 | { 253 | 254 | temp2 = temp1.Substring(temp1.Length - 7); 255 | data.Add(BitStreamToByte(temp2)); 256 | temp1 = temp1.Substring(0, temp1.Length - 7); 257 | } 258 | } 259 | return Encoding.UTF8.GetString(data.ToArray()); 260 | } 261 | } 262 | } 263 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/DockSearch.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class DockSearch 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(DockSearch)); 32 | this.splitContainer1 = new System.Windows.Forms.SplitContainer(); 33 | this.panel1 = new System.Windows.Forms.Panel(); 34 | this.textBoxSearch = new System.Windows.Forms.TextBox(); 35 | this.splitContainer2 = new System.Windows.Forms.SplitContainer(); 36 | this.splitContainer3 = new System.Windows.Forms.SplitContainer(); 37 | this.buttonPrev = new System.Windows.Forms.Button(); 38 | this.buttonNext = new System.Windows.Forms.Button(); 39 | this.buttonSearch = new System.Windows.Forms.Button(); 40 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer1)).BeginInit(); 41 | this.splitContainer1.Panel1.SuspendLayout(); 42 | this.splitContainer1.Panel2.SuspendLayout(); 43 | this.splitContainer1.SuspendLayout(); 44 | this.panel1.SuspendLayout(); 45 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer2)).BeginInit(); 46 | this.splitContainer2.Panel1.SuspendLayout(); 47 | this.splitContainer2.Panel2.SuspendLayout(); 48 | this.splitContainer2.SuspendLayout(); 49 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer3)).BeginInit(); 50 | this.splitContainer3.Panel1.SuspendLayout(); 51 | this.splitContainer3.Panel2.SuspendLayout(); 52 | this.splitContainer3.SuspendLayout(); 53 | this.SuspendLayout(); 54 | // 55 | // splitContainer1 56 | // 57 | this.splitContainer1.BackColor = System.Drawing.SystemColors.Window; 58 | this.splitContainer1.Dock = System.Windows.Forms.DockStyle.Fill; 59 | this.splitContainer1.FixedPanel = System.Windows.Forms.FixedPanel.Panel2; 60 | this.splitContainer1.IsSplitterFixed = true; 61 | this.splitContainer1.Location = new System.Drawing.Point(0, 0); 62 | this.splitContainer1.Name = "splitContainer1"; 63 | // 64 | // splitContainer1.Panel1 65 | // 66 | this.splitContainer1.Panel1.Controls.Add(this.panel1); 67 | this.splitContainer1.Panel1MinSize = 0; 68 | // 69 | // splitContainer1.Panel2 70 | // 71 | this.splitContainer1.Panel2.Controls.Add(this.splitContainer2); 72 | this.splitContainer1.Panel2MinSize = 80; 73 | this.splitContainer1.Size = new System.Drawing.Size(584, 22); 74 | this.splitContainer1.SplitterDistance = 400; 75 | this.splitContainer1.TabIndex = 0; 76 | // 77 | // panel1 78 | // 79 | this.panel1.Controls.Add(this.textBoxSearch); 80 | this.panel1.Dock = System.Windows.Forms.DockStyle.Fill; 81 | this.panel1.Location = new System.Drawing.Point(0, 0); 82 | this.panel1.Name = "panel1"; 83 | this.panel1.Size = new System.Drawing.Size(400, 22); 84 | this.panel1.TabIndex = 0; 85 | // 86 | // textBoxSearch 87 | // 88 | this.textBoxSearch.BorderStyle = System.Windows.Forms.BorderStyle.None; 89 | this.textBoxSearch.Location = new System.Drawing.Point(0, 5); 90 | this.textBoxSearch.Name = "textBoxSearch"; 91 | this.textBoxSearch.Size = new System.Drawing.Size(100, 14); 92 | this.textBoxSearch.TabIndex = 0; 93 | // 94 | // splitContainer2 95 | // 96 | this.splitContainer2.Dock = System.Windows.Forms.DockStyle.Fill; 97 | this.splitContainer2.Location = new System.Drawing.Point(0, 0); 98 | this.splitContainer2.Name = "splitContainer2"; 99 | // 100 | // splitContainer2.Panel1 101 | // 102 | this.splitContainer2.Panel1.Controls.Add(this.splitContainer3); 103 | // 104 | // splitContainer2.Panel2 105 | // 106 | this.splitContainer2.Panel2.Controls.Add(this.buttonSearch); 107 | this.splitContainer2.Size = new System.Drawing.Size(180, 22); 108 | this.splitContainer2.SplitterDistance = 60; 109 | this.splitContainer2.TabIndex = 0; 110 | // 111 | // splitContainer3 112 | // 113 | this.splitContainer3.Dock = System.Windows.Forms.DockStyle.Fill; 114 | this.splitContainer3.Location = new System.Drawing.Point(0, 0); 115 | this.splitContainer3.Name = "splitContainer3"; 116 | // 117 | // splitContainer3.Panel1 118 | // 119 | this.splitContainer3.Panel1.Controls.Add(this.buttonPrev); 120 | // 121 | // splitContainer3.Panel2 122 | // 123 | this.splitContainer3.Panel2.Controls.Add(this.buttonNext); 124 | this.splitContainer3.Size = new System.Drawing.Size(60, 22); 125 | this.splitContainer3.SplitterDistance = 28; 126 | this.splitContainer3.TabIndex = 0; 127 | // 128 | // buttonPrev 129 | // 130 | this.buttonPrev.Dock = System.Windows.Forms.DockStyle.Fill; 131 | this.buttonPrev.Location = new System.Drawing.Point(0, 0); 132 | this.buttonPrev.Name = "buttonPrev"; 133 | this.buttonPrev.Size = new System.Drawing.Size(28, 22); 134 | this.buttonPrev.TabIndex = 0; 135 | this.buttonPrev.Text = "◀"; 136 | this.buttonPrev.UseVisualStyleBackColor = true; 137 | this.buttonPrev.Click += new System.EventHandler(this.buttonPrev_Click); 138 | // 139 | // buttonNext 140 | // 141 | this.buttonNext.Dock = System.Windows.Forms.DockStyle.Fill; 142 | this.buttonNext.Location = new System.Drawing.Point(0, 0); 143 | this.buttonNext.Name = "buttonNext"; 144 | this.buttonNext.Size = new System.Drawing.Size(28, 22); 145 | this.buttonNext.TabIndex = 0; 146 | this.buttonNext.Text = "▶"; 147 | this.buttonNext.UseVisualStyleBackColor = true; 148 | this.buttonNext.Click += new System.EventHandler(this.buttonNext_Click); 149 | // 150 | // buttonSearch 151 | // 152 | this.buttonSearch.Dock = System.Windows.Forms.DockStyle.Fill; 153 | this.buttonSearch.Location = new System.Drawing.Point(0, 0); 154 | this.buttonSearch.Name = "buttonSearch"; 155 | this.buttonSearch.Size = new System.Drawing.Size(116, 22); 156 | this.buttonSearch.TabIndex = 0; 157 | this.buttonSearch.Text = "Find"; 158 | this.buttonSearch.UseVisualStyleBackColor = true; 159 | this.buttonSearch.Click += new System.EventHandler(this.buttonSearch_Click); 160 | // 161 | // DockSearch 162 | // 163 | this.AllowEndUserDocking = false; 164 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.None; 165 | this.ClientSize = new System.Drawing.Size(584, 22); 166 | this.Controls.Add(this.splitContainer1); 167 | this.DockAreas = WeifenLuo.WinFormsUI.Docking.DockAreas.DockTop; 168 | this.Font = new System.Drawing.Font("굴림", 9F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(129))); 169 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.None; 170 | this.HideOnClose = true; 171 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 172 | this.MaximizeBox = false; 173 | this.MinimizeBox = false; 174 | this.Name = "DockSearch"; 175 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 176 | this.Text = "Find"; 177 | this.DockStateChanged += new System.EventHandler(this.DockSearch_DockStateChanged); 178 | this.Resize += new System.EventHandler(this.DockSearch_Resize); 179 | this.splitContainer1.Panel1.ResumeLayout(false); 180 | this.splitContainer1.Panel2.ResumeLayout(false); 181 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer1)).EndInit(); 182 | this.splitContainer1.ResumeLayout(false); 183 | this.panel1.ResumeLayout(false); 184 | this.panel1.PerformLayout(); 185 | this.splitContainer2.Panel1.ResumeLayout(false); 186 | this.splitContainer2.Panel2.ResumeLayout(false); 187 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer2)).EndInit(); 188 | this.splitContainer2.ResumeLayout(false); 189 | this.splitContainer3.Panel1.ResumeLayout(false); 190 | this.splitContainer3.Panel2.ResumeLayout(false); 191 | ((System.ComponentModel.ISupportInitialize)(this.splitContainer3)).EndInit(); 192 | this.splitContainer3.ResumeLayout(false); 193 | this.ResumeLayout(false); 194 | 195 | } 196 | 197 | #endregion 198 | 199 | private System.Windows.Forms.SplitContainer splitContainer1; 200 | private System.Windows.Forms.Panel panel1; 201 | private System.Windows.Forms.TextBox textBoxSearch; 202 | private System.Windows.Forms.SplitContainer splitContainer2; 203 | private System.Windows.Forms.SplitContainer splitContainer3; 204 | private System.Windows.Forms.Button buttonPrev; 205 | private System.Windows.Forms.Button buttonNext; 206 | private System.Windows.Forms.Button buttonSearch; 207 | } 208 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormSave.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using System.IO; 10 | using IE10Analyzer.EDBParser; 11 | using System.Reflection; 12 | 13 | namespace IE10Analyzer 14 | { 15 | public partial class FormSave : Form 16 | { 17 | private String saveForm; 18 | private String savePath; 19 | private String saveTime; 20 | private List tableList; 21 | private EsentManager esentManager; 22 | private EDBParserManager edbParserManager; 23 | private bool useAPI = false; 24 | private bool recoveryRecord = false; 25 | private bool parseRecord = false; 26 | public FormSave(String saveForm, ListtableList, bool useAPI, bool parseRecord, bool recoveryRecord) 27 | { 28 | InitializeComponent(); 29 | this.useAPI = useAPI; 30 | this.recoveryRecord = recoveryRecord; 31 | this.parseRecord = parseRecord; 32 | this.saveForm = saveForm; 33 | this.tableList = tableList; 34 | listViewTable.BeginUpdate(); 35 | foreach (ListViewItem listViewItem in tableList) 36 | { 37 | ListViewItem inputIistViewItem = (ListViewItem)listViewItem.Clone(); 38 | this.listViewTable.Items.Add(inputIistViewItem); 39 | 40 | } 41 | listViewTable.EndUpdate(); 42 | this.esentManager = null; 43 | this.edbParserManager = null; 44 | 45 | } 46 | 47 | public void FormSaveSetData(EsentManager esentManager, EDBParserManager edbParserManager) 48 | { 49 | this.esentManager = esentManager; 50 | this.edbParserManager = edbParserManager; 51 | } 52 | 53 | public delegate void saveRecordList(List columnList, List listViewItemList); 54 | public saveRecordList saveRecordListDelegate; 55 | public bool saveRecordListMethod(String tableName, List columnList, List listViewItemList) 56 | { 57 | if (listViewItemList.Count == 0) 58 | { 59 | return false; 60 | } 61 | listViewItemList.Sort(compareRecord); 62 | if (saveForm.Equals("CSV")) 63 | { 64 | writeCSV(tableName, columnList, listViewItemList); 65 | } 66 | else if(saveForm.Equals("SQL")) 67 | { 68 | if (!File.Exists("System.Data.SQLite.dll")) 69 | { 70 | using (Stream input = Assembly.GetExecutingAssembly().GetManifestResourceStream("IEForensic.Resources.System.Data.SQLite.dll")) 71 | using (Stream output = File.Create("System.Data.SQLite.dll")) 72 | { 73 | byte[] buffer = new byte[8192]; 74 | 75 | int bytesRead; 76 | while ((bytesRead = input.Read(buffer, 0, buffer.Length)) > 0) 77 | { 78 | output.Write(buffer, 0, bytesRead); 79 | } 80 | } 81 | } 82 | writeSQL(tableName, columnList, listViewItemList); 83 | } 84 | 85 | return true; 86 | } 87 | 88 | public void closeForm(){ 89 | this.Close(); 90 | } 91 | 92 | private void saveUsingAPI(){ 93 | if (listViewTable.CheckedItems.Count != 0) 94 | { 95 | for (int i = 0; i < listViewTable.CheckedItems.Count; i++) 96 | { 97 | String tableName = listViewTable.CheckedItems[i].SubItems[1].Text.ToString(); 98 | List columnInformationList = esentManager.getColumn(tableName); 99 | columnInformationList.Sort(compareColumn); 100 | esentManager.saveData(this, tableName, columnInformationList); 101 | } 102 | } 103 | MessageBox.Show("The operation has been completed!"); 104 | } 105 | 106 | private void saveParsingRecord(){ 107 | if (listViewTable.CheckedItems.Count != 0) 108 | { 109 | for (int i = 0; i < listViewTable.CheckedItems.Count; i++) 110 | { 111 | String tableNumber = listViewTable.CheckedItems[i].SubItems[0].Text; 112 | String tableName = listViewTable.CheckedItems[i].SubItems[1].Text; 113 | Table table = edbParserManager.getTable(Int32.Parse(tableNumber)); 114 | edbParserManager.saveData(this, table, true); //normal 115 | } 116 | } 117 | MessageBox.Show("The operation has been completed!"); 118 | } 119 | 120 | private void saveRecoveryRecord() 121 | { 122 | if (listViewTable.CheckedItems.Count != 0) 123 | { 124 | for (int i = 0; i < listViewTable.CheckedItems.Count; i++) 125 | { 126 | String tableNumber = listViewTable.CheckedItems[i].SubItems[0].Text; 127 | String tableName = listViewTable.CheckedItems[i].SubItems[1].Text; 128 | Table table = edbParserManager.getTable(Int32.Parse(tableNumber)); 129 | edbParserManager.saveData(this, table, false); //recovery 130 | } 131 | } 132 | MessageBox.Show("The operation has been completed!"); 133 | } 134 | 135 | private bool writeCSV(String tableName, List columnList, List listViewItemList) 136 | { 137 | 138 | CsvFileWriter csvFileWriter; 139 | FileStream m_fileStream; 140 | try 141 | { 142 | m_fileStream = new FileStream(this.savePath +"\\"+ this.saveTime + "_" + tableName+".csv", FileMode.Append, FileAccess.Write); 143 | 144 | csvFileWriter = new CsvFileWriter(m_fileStream, System.Text.Encoding.UTF8); 145 | csvFileWriter.WriteRow(columnList); 146 | 147 | List dataList = new List(); 148 | foreach (ListViewItem listViewItem in listViewItemList) 149 | { 150 | dataList.Clear(); 151 | foreach (ListViewItem.ListViewSubItem data in listViewItem.SubItems) 152 | { 153 | if (data == listViewItem.SubItems[0]) 154 | { 155 | continue; 156 | } 157 | dataList.Add(data.Text); 158 | } 159 | csvFileWriter.WriteRow(dataList); 160 | } 161 | csvFileWriter.Close(); 162 | m_fileStream.Close(); 163 | return true; 164 | } 165 | catch (Exception exception) 166 | { 167 | MessageBox.Show("" + exception); 168 | return false; 169 | } 170 | 171 | } 172 | 173 | private bool writeSQL(String tableName, List columnList, List listViewItemList) 174 | { 175 | 176 | SqlManager sqlManager = new SqlManager(this.savePath); 177 | 178 | if (sqlManager.open()) 179 | { 180 | if (!sqlManager.insertTable(tableName, columnList, listViewItemList)) 181 | { 182 | return false; 183 | } 184 | sqlManager.close(); 185 | return true; 186 | } 187 | return false; 188 | 189 | } 190 | 191 | private void listViewTable_ColumnClick(object sender, ColumnClickEventArgs e) 192 | { 193 | // 방향 초기화 194 | for (int i = 0; i < listViewTable.Columns.Count; i++) 195 | { 196 | listViewTable.Columns[i].Text = listViewTable.Columns[i].Text.Replace(" △", ""); 197 | listViewTable.Columns[i].Text = listViewTable.Columns[i].Text.Replace(" ▽", ""); 198 | } 199 | 200 | // DESC 201 | if (this.listViewTable.Sorting == SortOrder.Ascending || listViewTable.Sorting == SortOrder.None) 202 | { 203 | this.listViewTable.ListViewItemSorter = new ListViewItemComparer(e.Column, "desc"); 204 | listViewTable.Sorting = SortOrder.Descending; 205 | listViewTable.Columns[e.Column].Text = listViewTable.Columns[e.Column].Text + " ▽"; 206 | } 207 | // ASC 208 | else 209 | { 210 | this.listViewTable.ListViewItemSorter = new ListViewItemComparer(e.Column, "asc"); 211 | listViewTable.Sorting = SortOrder.Ascending; 212 | listViewTable.Columns[e.Column].Text = listViewTable.Columns[e.Column].Text + " △"; 213 | } 214 | listViewTable.Sort(); 215 | } 216 | 217 | 218 | public void setAutoColumnSize() 219 | { 220 | //listViewTable.AutoResizeColumns(ColumnHeaderAutoResizeStyle.ColumnContent); 221 | listViewTable.AutoResizeColumns(ColumnHeaderAutoResizeStyle.HeaderSize); 222 | listViewTable.Update(); 223 | } 224 | 225 | private void buttonCheckAll_Click(object sender, EventArgs e) 226 | { 227 | listViewTable.BeginUpdate(); 228 | for (int i = 0; i < listViewTable.Items.Count; i++) 229 | { 230 | listViewTable.Items[i].Checked = true; 231 | } 232 | listViewTable.EndUpdate(); 233 | } 234 | 235 | private void buttonUnCheck_Click(object sender, EventArgs e) 236 | { 237 | listViewTable.BeginUpdate(); 238 | for (int i = 0; i < listViewTable.Items.Count; i++) 239 | { 240 | listViewTable.Items[i].Checked = false; 241 | } 242 | listViewTable.EndUpdate(); 243 | } 244 | 245 | private void buttonSave_Click(object sender, EventArgs e) 246 | { 247 | SaveFileDialog sf = new SaveFileDialog(); 248 | sf.CheckFileExists = false; 249 | this.saveTime = DateTime.Now.ToString("yyyy_MM_dd_HH_mm_ss"); 250 | string dummyFileName = this.saveTime; 251 | if(saveForm.Equals("SQL")){ 252 | dummyFileName += ".db"; 253 | sf.Filter = "db (*.db)|*.db"; 254 | }else{ 255 | dummyFileName += "_tableName.csv"; 256 | sf.Filter = "csv(*.csv)|*.csv"; 257 | } 258 | sf.FileName = dummyFileName; 259 | 260 | if (sf.ShowDialog() == DialogResult.OK) 261 | { 262 | if(saveForm.Equals("CSV")){ 263 | this.savePath = Path.GetDirectoryName(sf.FileName); 264 | } 265 | else if(saveForm.Equals("SQL")){ 266 | this.savePath = sf.FileName; 267 | } 268 | 269 | if (useAPI) { 270 | saveUsingAPI(); 271 | }else if (parseRecord) { 272 | saveParsingRecord(); 273 | } 274 | else if (recoveryRecord) { 275 | saveRecoveryRecord(); 276 | } 277 | 278 | } 279 | } 280 | 281 | public int compareColumn(ColumnInformation x, ColumnInformation y) 282 | { 283 | if (x.getId() < y.getId()) 284 | { 285 | return -1; 286 | } 287 | else 288 | { 289 | return 0; 290 | } 291 | } 292 | 293 | public int compareRecord(ListViewItem listViewItemX, ListViewItem listViewItemY) 294 | { 295 | int x = 0; 296 | int y = 0; 297 | try { x = Int32.Parse(listViewItemX.SubItems[1].Text); } 298 | catch { } 299 | try { y = Int32.Parse(listViewItemY.SubItems[1].Text); } 300 | catch { } 301 | if (x < y) 302 | { 303 | return -1; 304 | } 305 | else 306 | { 307 | return 0; 308 | } 309 | } 310 | 311 | private void buttonCancle_Click(object sender, EventArgs e) 312 | { 313 | this.Close(); 314 | } 315 | } 316 | } 317 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/IEForensic.csproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Debug 5 | x86 6 | 8.0.30703 7 | 2.0 8 | {33CBC5DF-6630-4F4C-9CAC-1584DB2B7F7B} 9 | WinExe 10 | Properties 11 | IEForensic 12 | IE10Analyzer 13 | v4.0 14 | 15 | 16 | 512 17 | false 18 | publish\ 19 | true 20 | Disk 21 | false 22 | Foreground 23 | 7 24 | Days 25 | false 26 | false 27 | true 28 | 1 29 | 1.0.0.%2a 30 | false 31 | true 32 | 33 | 34 | x86 35 | true 36 | full 37 | true 38 | bin\Debug\ 39 | DEBUG;TRACE 40 | prompt 41 | 4 42 | true 43 | 44 | 45 | x86 46 | pdbonly 47 | true 48 | bin\Release\ 49 | TRACE 50 | prompt 51 | 4 52 | false 53 | 54 | 55 | IE10Analyzer.ico 56 | 57 | 58 | true 59 | bin\Debug\ 60 | DEBUG;TRACE 61 | true 62 | true 63 | full 64 | AnyCPU 65 | prompt 66 | false 67 | false 68 | 69 | 70 | bin\Release\ 71 | TRACE 72 | true 73 | pdbonly 74 | AnyCPU 75 | prompt 76 | false 77 | false 78 | 79 | 80 | true 81 | bin\x64\Debug\ 82 | 83 | 84 | true 85 | true 86 | full 87 | x86 88 | prompt 89 | false 90 | false 91 | 92 | 93 | bin\x64\Release\ 94 | 95 | 96 | true 97 | pdbonly 98 | x86 99 | prompt 100 | false 101 | false 102 | true 103 | 104 | 105 | LocalIntranet 106 | 107 | 108 | false 109 | 110 | 111 | Properties\app.manifest 112 | 113 | 114 | false 115 | 116 | 117 | 118 | ..\dll\Esent.Interop.dll 119 | 120 | 121 | 122 | 123 | ..\dll\System.Data.SQLite.dll 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | ..\dll\WeifenLuo.WinFormsUI.Docking.dll 138 | 139 | 140 | 141 | 142 | Form 143 | 144 | 145 | About.cs 146 | 147 | 148 | 149 | 150 | Form 151 | 152 | 153 | DockRecordList.cs 154 | 155 | 156 | Form 157 | 158 | 159 | DockSearch.cs 160 | 161 | 162 | Form 163 | 164 | 165 | DockTableList.cs 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | Form 178 | 179 | 180 | FormDetailView.cs 181 | 182 | 183 | Form 184 | 185 | 186 | FormInputUTCTime.cs 187 | 188 | 189 | Form 190 | 191 | 192 | FormMain.cs 193 | 194 | 195 | Form 196 | 197 | 198 | FormOpen.cs 199 | 200 | 201 | Form 202 | 203 | 204 | FormSave.cs 205 | 206 | 207 | Form 208 | 209 | 210 | FormWait.cs 211 | 212 | 213 | 214 | 215 | 216 | 217 | True 218 | True 219 | Resources.resx 220 | 221 | 222 | 223 | 224 | About.cs 225 | 226 | 227 | DockRecordList.cs 228 | 229 | 230 | DockSearch.cs 231 | 232 | 233 | DockTableList.cs 234 | 235 | 236 | FormDetailView.cs 237 | 238 | 239 | FormInputUTCTime.cs 240 | 241 | 242 | FormMain.cs 243 | 244 | 245 | FormOpen.cs 246 | 247 | 248 | FormSave.cs 249 | 250 | 251 | FormWait.cs 252 | 253 | 254 | PublicResXFileCodeGenerator 255 | Designer 256 | Resources.Designer.cs 257 | 258 | 259 | 260 | 261 | 262 | PublicSettingsSingleFileGenerator 263 | Settings.Designer.cs 264 | 265 | 266 | True 267 | Settings.settings 268 | True 269 | 270 | 271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 | 279 | 280 | 281 | 282 | False 283 | Microsoft .NET Framework 4%28x86 및 x64%29 284 | true 285 | 286 | 287 | False 288 | .NET Framework 3.5 SP1 Client Profile 289 | false 290 | 291 | 292 | False 293 | .NET Framework 3.5 SP1 294 | false 295 | 296 | 297 | False 298 | Windows Installer 3.1 299 | true 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 314 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormInputUTCTime.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using System.Collections; 10 | 11 | namespace IE10Analyzer 12 | { 13 | public partial class FormInputUTCTime : Form 14 | { 15 | private Dictionary timeZoneDictnary = new Dictionary(); 16 | private String UtcTime; 17 | public FormInputUTCTime() 18 | { 19 | InitializeComponent(); 20 | inputTImeZone(); 21 | 22 | foreach (String utcTime in timeZoneDictnary.Keys) 23 | { 24 | comboBoxUTCTime.Items.Add(utcTime); 25 | } 26 | comboBoxUTCTime.SelectedItem = "UTC+0"; 27 | } 28 | 29 | public String getUTCTime() 30 | { 31 | return UtcTime; 32 | } 33 | 34 | private void inputTImeZone(){ 35 | timeZoneDictnary.Add("UTC-12", "Baker Island\r\nU.S. Minor Outlying Islands\r\nHowland Island"); 36 | timeZoneDictnary.Add("UTC-11", "American Samoa\r\nPago Pago\r\nNiue\r\nAlofi\r\nU.S. Minor Outlying Islands\r\nItascatown pre-WW2"); 37 | timeZoneDictnary.Add("UTC-10", "Cook Islands\r\nAvarua\r\nFrench Polynesia\r\nPapeete\r\nU.S. Minor Outlying Islands\r\nMillersville - pre-WW2 settlement\r\nUnited States\r\nHawaii\r\nHonolulu"); 38 | timeZoneDictnary.Add("UTC-9:30", "Atuona\r\nFrench Polynesia"); 39 | timeZoneDictnary.Add("UTC-9", "French Polynesia\r\nRikitea\r\nUnited States"); 40 | timeZoneDictnary.Add("UTC-8", "Adamstown\r\nAlaska\r\nAnchorage\r\nPitcairn Islands\r\nUnited States"); 41 | timeZoneDictnary.Add("UTC-7", "Arizona\r\nBritish Columbia\r\nCalifornia\r\nCanada\r\nLos Angeles\r\nMexicali\r\nMexico\r\nNevada\r\nOregon\r\nPhoenix\r\nSan Diego\r\nSan Francisco\r\nSan Jose\r\nSurrey\r\nTijuana\r\nUnited States\r\nVancouver\r\nWashington\r\nYukon"); 42 | timeZoneDictnary.Add("UTC-6", "Alberta\r\nBelize\r\nBelmopan\r\nCalgary\r\nCanada\r\nCosta Rica\r\nEdmonton\r\nLimón\r\nNorthwest Territories\r\nNunavut\r\nSan José\r\nSaskatchewan"); 43 | timeZoneDictnary.Add("UTC-5", "Acre\r\nAlabama\r\nArequipa\r\nArkansas\r\nAustin\r\nBarranquilla\r\nBogotá\r\nBrazil\r\nCali\r\nCanada\r\nCartagena\r\nCayman Islands\r\nChicago\r\nChile\r\nCiudad Neza\r\nColombia\r\nDallas\r\nEcatepec de Morelos\r\nEcuador\r\nFort Worth\r\nGeorge Town\r\nGuadalajara\r\nGuayaquil\r\nHaiti\r\nHouston\r\nIllinois\r\nIowa\r\nJamaica\r\nKansas\r\nKansas City\r\nKingston\r\nLeón\r\nLima\r\nLouisiana\r\nManitoba\r\nMedellín\r\nMemphis\r\nMexico City\r\nMexico\r\nMilwaukee\r\nMinneapolis\r\nMinnesota\r\nMississippi\r\nMissouri\r\nMonterrey\r\nNashville\r\nNebraska\r\nNorth Dakota\r\nOklahoma\r\nOklahoma City\r\nOmaha\r\nPanama City\r\nPanama\r\nPeru\r\nPort-au-Prince\r\nPuebla\r\nQuito\r\nRio Branco\r\nSan Antonio\r\nSouth Dakota\r\nSpanish Town\r\nTennessee\r\nTexas\r\nTrujillo\r\nTulsa\r\nUnited States\r\nWinnipeg\r\nWisconsin"); 44 | timeZoneDictnary.Add("UTC-4", "Anguilla\r\nAmazonas\r\nAntigua and Barbuda\r\nAruba\r\nAsunción\r\nAtlanta\r\nBahamas\r\nBaltimore\r\nBarbados\r\nBasseterre\r\nBasse-Terre\r\nBolivia\r\nBonaire\r\nSint Eustatius and Saba\r\nBoston\r\nBrazil\r\nBridgetown\r\nBritish Virgin Islands\r\nCampo Grande\r\nCanada\r\nCaracas\r\nCarolina\r\nCastries\r\nChaguanas\r\nCharlotte\r\nCharlotte Amalie\r\nCincinnati\r\nCiudad del Este\r\nCleveland\r\nCockburn Town\r\nColumbus\r\nConnecticut\r\nCuba\r\nCuraçao\r\nDelaware\r\nDetroit\r\nDominica\r\nDominican Republic\r\nFlorida\r\nFort-de-France\r\nGeorgetown\r\nGeorgia\r\nGrenada\r\nGuadeloupe\r\nGustavia\r\nGuyana\r\nHavana\r\nIndiana\r\nIndianapolis\r\nJacksonville\r\nKentucky\r\nKingstown\r\nKralendijk\r\nLa Paz\r\nLexington-Fayette\r\nMaine\r\nManaus\r\nMaracaibo\r\nMaracay\r\nMarigot\r\nMartinique\r\nMaryland\r\nMassachusetts\r\nMato Grosso\r\nMato Grosso do Sul\r\nMiami\r\nMichigan\r\nMontreal\r\nMontserrat\r\nNassau\r\nNew Hampshire\r\nNew Jersey\r\nNew York\r\nNorth Carolina\r\nOhio\r\nOntario\r\nOranjestad\r\nOttawa\r\nPará\r\nParaguay\r\nPennsylvania\r\nPhiladelphia\r\nPittsburgh\r\nPlymouth\r\nPort of Spain\r\nPuerto Rico\r\nQuebec\r\nRaleigh\r\nRhode Island\r\nRoad Town\r\nRondônia\r\nRoraima\r\nRoseau\r\nSaint Kitts and Nevis\r\nSaint Lucia\r\nSaint Martin\r\nSaint Vincent and the Grenadines\r\nSaint-Barthélemy\r\nSan Juan\r\nSanta Cruz\r\nSantiago de Cuba\r\nSantiago de los Caballeros\r\nSanto Domingo\r\nSouth Carolina\r\nSt. George's\r\nSt. John's\r\nStaten Island\r\nTampa\r\nThe Valley\r\nToronto\r\nTrinidad and Tobago\r\nTurks and Caicos Islands\r\nU.S. Virgin Islands\r\nUnited States\r\nVenezuela\r\nVermont\r\nVirginia\r\nVirginia Beach\r\nWashington\r\nD.C.\r\nWest Virginia\r\nWillemstad"); 45 | timeZoneDictnary.Add("UTC-3", "Alagoas\r\nAmapá\r\nArgentina\r\nBahia\r\nBelém\r\nBelo Horizonte\r\nBermuda\r\nBrasília\r\nBrazil\r\nBuenos Aires\r\nCanada\r\nCayenne\r\nCeará\r\nChile\r\nCórdoba\r\nCuritiba\r\nEspírito Santo\r\nFalkland Islands\r\nFederal District\r\nFortaleza\r\nFrench Guiana\r\nGoiás\r\nGreenland\r\nHalifax\r\nHamilton\r\nMaranhão\r\nMinas Gerais\r\nMontevideo\r\nNew Brunswick\r\nNova Scotia\r\nParaíba\r\nParamaribo\r\nParaná\r\nPernambuco\r\nPiauí\r\nPitugfik\r\nPorto Alegre\r\nPrince Edward Island\r\nPuente Alto\r\nRecife\r\nRio de Janeiro\r\nRio Grande do Norte\r\nRio Grande do Sul\r\nRosario\r\nSaint John\r\nSalto\r\nSalvador\r\nSanta Catarina\r\nSantiago\r\nSão Paulo\r\nSergipe\r\nStanley\r\nSuriname\r\nTocantins\r\nUruguay "); 46 | timeZoneDictnary.Add("UTC-2:30", "Canada\r\nNewfoundland and Labrador\r\nSt Johns"); 47 | timeZoneDictnary.Add("UTC-2", "Brazil\r\nGreenland\r\nNuuk\r\nSaint Pierre and Miquelon\r\nSaint-Pierre\r\nSouth Georgia and South Sandwich Islands"); 48 | timeZoneDictnary.Add("UTC-1", "Cape Verde,Praia"); 49 | timeZoneDictnary.Add("UTC+0", "Azores\r\nAbidjan\r\nAccra\r\nBafatá\r\nBamako\r\nBanjul\r\nBissau\r\nBo\r\nBobo-Dioulasso\r\nBouaké\r\nBurkina Faso\r\nConakry\r\nDakar\r\nFreetown\r\nGambia\r\nGhana\r\nGreenland\r\nGuinea\r\nGuinea-Bissau\r\nIceland\r\nIttoqqortoormiit\r\nIvory Coast\r\nJamestown\r\nKumasi\r\nLiberia\r\nLomé\r\nMali\r\nMauritania\r\nMonrovia\r\nNouadhibou\r\nNouakchott\r\nNzérékoré\r\nOuagadougou\r\nPonta Delgada\r\nReykjavik\r\nSaint Helena\r\nSão Tomé and Príncipe\r\nSenegal\r\nSierra Leone\r\nSikasso\r\nSokodé\r\nTogo\r\nTouba\r\nYamoussoukro"); 50 | timeZoneDictnary.Add("UTC+1", "Aba\r\nAbomey-Calavi\r\nAbuja\r\nAlgeria\r\nAlgiers\r\nAngola\r\nBangui\r\nBata\r\nBenin City\r\nBenin\r\nBimbo\r\nBirmingham\r\nBoumerdas\r\nBrazzaville\r\nBristol\r\nCameroon\r\nCanary Islands\r\nCasablanca\r\nCentral African Republic\r\nChad\r\nCongo-Brazzaville\r\nCongo-Kinshasa\r\nCork\r\nDouala\r\nDublin\r\nEdinburgh\r\nEquatorial Guinea\r\nFaroe Islands\r\nGabon\r\nGlasgow\r\nGuernsey\r\nIbadan\r\nIreland\r\nIsle of Man\r\nJersey\r\nKaduna\r\nKano\r\nKikwit\r\nKinshasa\r\nLagos\r\nLas Palmas\r\nLeeds\r\nLeicester\r\nLibreville\r\nLisbon\r\nLiverpool\r\nLondon\r\nLuanda\r\nMaiduguri\r\nMalabo\r\nManchester\r\nMorocco\r\nMoundou\r\nNamibia\r\nN'dalatando\r\nN'Djamena\r\nNiamey\r\nNiger\r\nNigeria\r\nOran\r\nPointe-Noire\r\nPort Harcourt\r\nPort-Gentil\r\nPorto\r\nPorto-Novo\r\nPortugal\r\nRabat\r\nRundu\r\nSheffield\r\nTórshavn\r\nTunis\r\nTunisia\r\nUnited Kingdom\r\nWestern Sahara\r\nWindhoek\r\nYaoundé\r\nZaria"); 51 | timeZoneDictnary.Add("UTC+2", "Albania\r\nAarhus\r\nAlexandria\r\nAmsterdam\r\nAndorra\r\nAntwerp\r\nAustria\r\nBarcelona\r\nBelgium\r\nBelgrade\r\nBergen\r\nBerlin\r\nBern\r\nBitola\r\nBlantyre\r\nBosnia and Herzegovina\r\nBotswana\r\nBratislava\r\nBrno\r\nBrussels\r\nBudapest\r\nBujumbura\r\nBulawayo\r\nBurundi\r\nCairo\r\nCape Town\r\nCologne\r\nCongo-Kinshasa\r\nCopenhagen\r\nCroatia\r\nCzechia\r\nDebrecen\r\nDenmark\r\nDurban\r\nDurrës\r\nEgypt\r\nEssen\r\nFrance\r\nFrancistown\r\nFrankfurt\r\nGaborone\r\nGermany\r\nGibraltar\r\nGothenburg\r\nGraz\r\nHamburg\r\nHarare\r\nHungary\r\nItaly\r\nJohannesburg\r\nKaliningrad\r\nKigali\r\nKisangani\r\nKitwe\r\nKošice\r\nKrakow\r\nLesotho\r\nLibya\r\nLiechtenstein\r\nLilongwe\r\nLjubljana\r\nŁódź\r\nLubumbashi\r\nLusaka\r\nLuxembourg\r\nLyon\r\nMacedonia\r\nMadrid\r\nMafeteng\r\nMalawi\r\nMalta\r\nManzini\r\nMaputo\r\nMaribor\r\nMarseille\r\nMaseru\r\nMatola\r\nMbabane\r\nMbuji-Mayi\r\nMilan\r\nMonaco\r\nMontenegro\r\nMozambique\r\nMunich\r\nMuyinga\r\nNaples\r\nNetherlands\r\nNice\r\nNiš\r\nNorway\r\nOslo\r\nPalermo\r\nParis\r\nPodgorica\r\nPoland\r\nPort Said\r\nPrague\r\nPretoria\r\nRome\r\nRussia\r\nRwanda\r\nSan Marino\r\nSarajevo\r\nSerbia\r\nSeville\r\nSkopje\r\nSlovakia\r\nSlovenia\r\nSouth Africa\r\nSoweto\r\nSpain\r\nStockholm\r\nStuttgart\r\nSwaziland\r\nSweden\r\nSwitzerland\r\nThe Hague\r\nTirana\r\nToulouse\r\nTripoli\r\nTurin\r\nValencia\r\nValletta\r\nVatican City\r\nVienna\r\nWarsaw\r\nZagreb\r\nZambia\r\nZaragoza\r\nZimbabwe\r\nZurich"); 52 | timeZoneDictnary.Add("UTC+3", "Adana\r\nAddis Ababa\r\nAl Ahmadi\r\nAl Hudaydah\r\nÅland\r\nAleppo\r\nAmman\r\nAnkara\r\nAntananarivo\r\nAsmara\r\nAthens\r\nBaghdad\r\nBahir Dar\r\nBahrain\r\nBasra\r\nBeirut\r\nBelarus\r\nBucharest\r\nBulgaria\r\nBursa\r\nCheren\r\nChişinău\r\nComoros\r\nCyprus\r\nDamascus\r\nDar es Salaam\r\nDaugavpils\r\nDire Dawa\r\nDjibouti\r\nDjibouti\r\nDnipropetrovsk\r\nDodoma\r\nDoha\r\nDonetsk\r\nEritrea\r\nEspoo\r\nEstonia\r\nEthiopia\r\nFinland\r\nGaza\r\nGaziantep\r\nGomel\r\nGreece\r\nGulu\r\nHaifa\r\nHelsinki\r\nIași\r\nIraq\r\nIsrael\r\nIstanbul\r\nIzmir\r\nJeddah\r\nJerusalem\r\nJordan\r\nJuba\r\nKampala\r\nKassala\r\nKaunas\r\nKazan\r\nKenya\r\nKharkiv\r\nKhartoum\r\nKonya\r\nKuwait City\r\nKuwait\r\nKyiv\r\nLatvia\r\nLebanon\r\nLimassol\r\nLira\r\nLithuania\r\nMadagascar\r\nMalakal\r\nMamoutzou\r\nManama\r\nMariehamn\r\nMayotte\r\nMecca\r\nMek’elē\r\nMinsk\r\nMogadishu\r\nMogilev\r\nMoldova\r\nMombasa\r\nMoroni\r\nMoscow\r\nNairobi\r\nNakuru\r\nNazrēt\r\nNicosia\r\nNizhny Novgorod\r\nOdesa\r\nPalestine\r\nPlovdiv\r\nPort Sudan\r\nQatar\r\nRiga\r\nRiyadh\r\nRomania\r\nRostov-on-Don\r\nRussia\r\nSaint Petersburg\r\nSanaa\r\nSaudi Arabia\r\nSofia\r\nSomalia\r\nSouth Sudan\r\nSudan\r\nSyria\r\nTallinn\r\nTanzania\r\nTartu\r\nThessaloniki\r\nTiraspol\r\nToamasina\r\nTripoli\r\nTurkey\r\nUganda\r\nUkraine\r\nVilnius\r\nYemen\r\nZarqa"); 53 | timeZoneDictnary.Add("UTC+4", "Abu Dhabi\r\nArmenia\r\nAs Sīb al Jadīdah\r\nAzerbaijan\r\nBaku\r\nDubai\r\nGanja\r\nGeorgia\r\nKutaisi\r\nMauritius\r\nMuscat\r\nOman\r\nPort Louis\r\nRéunion\r\nRussia\r\nSaint-Denis\r\nSamara\r\nSeychelles\r\nTbilisi\r\nTolyatti\r\nUnited Arab Emirates\r\nVacoas\r\nVictoria\r\nYerevan"); 54 | timeZoneDictnary.Add("UTC+4:30", "Afghanistan\r\nIran\r\nIsfahan\r\nKabul\r\nKandahar\r\nKaraj\r\nMashhad\r\nMazari Sharif\r\nQom\r\nShiraz\r\nTabriz\r\nTehran"); 55 | timeZoneDictnary.Add("UTC+5", "Aqtöbe\r\nAshkabad\r\nChelyabinsk\r\nDushanbe\r\nFaisalabad\r\nFrench Southern Territories\r\nGujranwala\r\nHyderabad\r\nIslamabad\r\nKarachi\r\nKazakhstan\r\nKhujand\r\nLahore\r\nMaldives\r\nMalé\r\nMultan\r\nNamangan\r\nPakistan\r\nPeshawar\r\nPort-aux-Français\r\nQuetta\r\nRawalpindi\r\nRussia\r\nTajikistan\r\nTashkent\r\nTurkmenabat\r\nTurkmenistan\r\nUzbekistan\r\nYekaterinburg"); 56 | timeZoneDictnary.Add("UTC+5:30", "Ahmedabad\r\nBangalore\r\nChennai\r\nColombo\r\nGalkissa\r\nHyderabad\r\nIndia\r\nKanpur\r\nKolkata\r\nMumbai\r\nNew Delhi\r\nPune\r\nSri Lanka\r\nSurat"); 57 | timeZoneDictnary.Add("UTC+5:45", "Biratnagur\r\nKathmandu\r\nNepal\r\nPokhara"); 58 | timeZoneDictnary.Add("UTC+6", "Almaty\r\nAstana\r\nBangladesh\r\nBhutan\r\nBishkek\r\nBritish Indian Ocean Territory\r\nChittagong\r\nComilla\r\nCox’s Bāzār\r\nDhaka\r\nJessore\r\nKazakhstan\r\nKhulna\r\nKyrgyzstan\r\nNarsingdi\r\nNovosibirsk\r\nOmsk\r\nOsh\r\nRajshahi\r\nRangpur\r\nRussia\r\nThimphu\r\nTongi"); 59 | timeZoneDictnary.Add("UTC+6:30", "Burma  Cocos [Keeling] Islands Naypyidaw Yangon"); 60 | timeZoneDictnary.Add("UTC+7", "Bandung\r\nBangkok\r\nBekasi\r\nBiên Hòa\r\nCambodia\r\nChon Buri\r\nChristmas Island\r\nDa Nang\r\nDepok\r\nHaiphong\r\nHanoi\r\nHoChiMinh City\r\nHuế\r\nIndonesia\r\nJakarta\r\nKrasnoyarsk\r\nLaos\r\nMedan\r\nMueang Nonthaburi\r\nMueang Samut Prakan\r\nNha Trang\r\nNovokuznetsk\r\nPakxe\r\nPalembang\r\nPhnom Penh\r\nRussia\r\nSemarang\r\nSouth Tangerang\r\nSurabaya\r\nTakeo\r\nTangerang\r\nThailand\r\nUdon Thani\r\nVientiane\r\nVietnam "); 61 | timeZoneDictnary.Add("UTC+8", "Antipolo\r\nAustralia\r\nBacolod City\r\nBandar Seri Begawan\r\nBanjarmasin\r\nBeijing\r\nBrunei\r\nChengdu\r\nChina\r\nChongqing\r\nCity of Balikpapan\r\nCity of Cebu\r\nDadiangas\r\nDavao City\r\nDongguan\r\nGuangzhou\r\nHong Kong\r\nIndonesia\r\nIrkutsk\r\nKaohsiung\r\nKhovd\r\nKlang\r\nKota Bharu\r\nKuala Lumpur\r\nMacau\r\nMakassar\r\nMalaysia\r\nMandurah\r\nManila\r\nMongolia\r\nNanjing\r\nPerth\r\nPhilippines\r\nRussia\r\nShanghai\r\nShenzhen\r\nSingapore\r\nTaipei\r\nTaiwan\r\nTianjin\r\nWestern Australia\r\nWuhan\r\nZamboanga City"); 62 | timeZoneDictnary.Add("UTC+8:30", "Hamhung\r\nNorth Korea\r\nPyongyang"); 63 | timeZoneDictnary.Add("UTC+8:45", "Australia"); 64 | timeZoneDictnary.Add("UTC+9", "Ambon City\r\nBusan\r\nChita\r\nDili\r\nEast Timor\r\nErdenet\r\nIncheon\r\nIndonesia\r\nJapan\r\nJayapura\r\nMongolia\r\nOsaka\r\nPalau\r\nRussia\r\nSeoul\r\nSouth Korea\r\nTokyo\r\nUlan Bator\r\nYakutsk\r\nYokohama"); 65 | timeZoneDictnary.Add("UTC+9:30", "Adelaide\r\nAustralia\r\nDarwin\r\nNorthern Territory\r\nSouth Australia"); 66 | timeZoneDictnary.Add("UTC+10", "Australia\r\nAustralian Capital Territory\r\nCanberra\r\nGuam\r\nHagåtña\r\nKhabarovsk\r\nLae\r\nMicronesia\r\nMoen\r\nNew South Wales\r\nNorthern Mariana Islands\r\nPapua New Guinea\r\nPort Moresby\r\nQueensland\r\nRussia\r\nSydney\r\nTasmania\r\nVictoria\r\nVladivostok"); 67 | timeZoneDictnary.Add("UTC+10:30", "Australia"); 68 | timeZoneDictnary.Add("UTC+11", "Australia\r\nHoniara\r\nKingston\r\nMicronesia\r\nNew Caledonia\r\nNorfolk Island\r\nNoumea\r\nPalikir\r\nPort Vila\r\nRussia\r\nSolomon Islands\r\nVanuatu\r\nYuzhno-Sakhalinsk"); 69 | timeZoneDictnary.Add("UTC+12", "Auckland\r\nFiji\r\nKiribati\r\nMajuro\r\nMarshall Islands\r\nMata-Utu\r\nNauru\r\nNew Zealand\r\nPetropavlovsk-Kamchatsky\r\nRussia\r\nSuva\r\nTarawa\r\nTuvalu\r\nU.S. Minor Outlying Islands\r\nWallis and Futuna\r\nWellington"); 70 | timeZoneDictnary.Add("UTC+12:45", "New Zealand"); 71 | timeZoneDictnary.Add("UTC+13", "Apia\r\nKiribati\r\nNuku'alofa\r\nSamoa\r\nTokelau\r\nTonga"); 72 | timeZoneDictnary.Add("UTC+14", "Kiribati\r\nTabwakea Village"); 73 | 74 | 75 | } 76 | 77 | private void comboBoxUTCTime_SelectedValueChanged(object sender, EventArgs e) 78 | { 79 | textBoxCountry.Text = timeZoneDictnary[comboBoxUTCTime.SelectedItem.ToString()].ToString(); 80 | this.UtcTime = comboBoxUTCTime.SelectedItem.ToString(); 81 | } 82 | 83 | private void buttonSave_Click(object sender, EventArgs e) 84 | { 85 | this.DialogResult = DialogResult.OK; 86 | this.UtcTime = comboBoxUTCTime.SelectedItem.ToString(); 87 | Close(); 88 | } 89 | 90 | private void FormInputUTCTime_FormClosed(object sender, FormClosedEventArgs e) 91 | { 92 | this.DialogResult = DialogResult.OK; 93 | this.UtcTime = comboBoxUTCTime.SelectedItem.ToString(); 94 | Close(); 95 | } 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormOpen.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormOpen 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormOpen)); 32 | this.groupBox1 = new System.Windows.Forms.GroupBox(); 33 | this.radioButtonOpen = new System.Windows.Forms.RadioButton(); 34 | this.radioButtonExtract = new System.Windows.Forms.RadioButton(); 35 | this.groupBoxWorking = new System.Windows.Forms.GroupBox(); 36 | this.buttonWorkingDirectory = new System.Windows.Forms.Button(); 37 | this.textBoxWorkingDirectory = new System.Windows.Forms.TextBox(); 38 | this.groupBox3 = new System.Windows.Forms.GroupBox(); 39 | this.radioButtonRecovery = new System.Windows.Forms.RadioButton(); 40 | this.radioButtonParsing = new System.Windows.Forms.RadioButton(); 41 | this.radioButtonUsingAPI = new System.Windows.Forms.RadioButton(); 42 | this.groupBox4 = new System.Windows.Forms.GroupBox(); 43 | this.comboBoxBrowser = new System.Windows.Forms.ComboBox(); 44 | this.labelFileStatus = new System.Windows.Forms.Label(); 45 | this.buttonFilePath = new System.Windows.Forms.Button(); 46 | this.textBoxFilePath = new System.Windows.Forms.TextBox(); 47 | this.buttonOpen = new System.Windows.Forms.Button(); 48 | this.buttonCancel = new System.Windows.Forms.Button(); 49 | this.radioButtonCarving = new System.Windows.Forms.RadioButton(); 50 | this.groupBox1.SuspendLayout(); 51 | this.groupBoxWorking.SuspendLayout(); 52 | this.groupBox3.SuspendLayout(); 53 | this.groupBox4.SuspendLayout(); 54 | this.SuspendLayout(); 55 | // 56 | // groupBox1 57 | // 58 | this.groupBox1.Controls.Add(this.radioButtonOpen); 59 | this.groupBox1.Controls.Add(this.radioButtonExtract); 60 | this.groupBox1.Location = new System.Drawing.Point(12, 12); 61 | this.groupBox1.Name = "groupBox1"; 62 | this.groupBox1.Size = new System.Drawing.Size(451, 86); 63 | this.groupBox1.TabIndex = 0; 64 | this.groupBox1.TabStop = false; 65 | this.groupBox1.Text = "How to open"; 66 | // 67 | // radioButtonOpen 68 | // 69 | this.radioButtonOpen.AutoSize = true; 70 | this.radioButtonOpen.Location = new System.Drawing.Point(7, 55); 71 | this.radioButtonOpen.Name = "radioButtonOpen"; 72 | this.radioButtonOpen.Size = new System.Drawing.Size(348, 16); 73 | this.radioButtonOpen.TabIndex = 1; 74 | this.radioButtonOpen.TabStop = true; 75 | this.radioButtonOpen.Text = "Open WebCacheV01.dat that have already been extracted"; 76 | this.radioButtonOpen.UseVisualStyleBackColor = true; 77 | this.radioButtonOpen.CheckedChanged += new System.EventHandler(this.radioButtonOpen_CheckedChanged); 78 | // 79 | // radioButtonExtract 80 | // 81 | this.radioButtonExtract.AutoSize = true; 82 | this.radioButtonExtract.Location = new System.Drawing.Point(7, 26); 83 | this.radioButtonExtract.Name = "radioButtonExtract"; 84 | this.radioButtonExtract.Size = new System.Drawing.Size(412, 16); 85 | this.radioButtonExtract.TabIndex = 0; 86 | this.radioButtonExtract.TabStop = true; 87 | this.radioButtonExtract.Text = "Extract WebCacheV01.dat from current system and then open the file"; 88 | this.radioButtonExtract.UseVisualStyleBackColor = true; 89 | this.radioButtonExtract.CheckedChanged += new System.EventHandler(this.radioButtonExtract_CheckedChanged); 90 | // 91 | // groupBoxWorking 92 | // 93 | this.groupBoxWorking.Controls.Add(this.buttonWorkingDirectory); 94 | this.groupBoxWorking.Controls.Add(this.textBoxWorkingDirectory); 95 | this.groupBoxWorking.Location = new System.Drawing.Point(12, 334); 96 | this.groupBoxWorking.Name = "groupBoxWorking"; 97 | this.groupBoxWorking.Size = new System.Drawing.Size(451, 55); 98 | this.groupBoxWorking.TabIndex = 1; 99 | this.groupBoxWorking.TabStop = false; 100 | this.groupBoxWorking.Text = "Working directory"; 101 | // 102 | // buttonWorkingDirectory 103 | // 104 | this.buttonWorkingDirectory.Location = new System.Drawing.Point(403, 20); 105 | this.buttonWorkingDirectory.Name = "buttonWorkingDirectory"; 106 | this.buttonWorkingDirectory.Size = new System.Drawing.Size(42, 23); 107 | this.buttonWorkingDirectory.TabIndex = 1; 108 | this.buttonWorkingDirectory.Text = "..."; 109 | this.buttonWorkingDirectory.UseVisualStyleBackColor = true; 110 | this.buttonWorkingDirectory.Click += new System.EventHandler(this.buttonWorkingDirectory_Click); 111 | // 112 | // textBoxWorkingDirectory 113 | // 114 | this.textBoxWorkingDirectory.BackColor = System.Drawing.SystemColors.ButtonHighlight; 115 | this.textBoxWorkingDirectory.Location = new System.Drawing.Point(7, 22); 116 | this.textBoxWorkingDirectory.Name = "textBoxWorkingDirectory"; 117 | this.textBoxWorkingDirectory.ReadOnly = true; 118 | this.textBoxWorkingDirectory.Size = new System.Drawing.Size(389, 21); 119 | this.textBoxWorkingDirectory.TabIndex = 0; 120 | // 121 | // groupBox3 122 | // 123 | this.groupBox3.Controls.Add(this.radioButtonCarving); 124 | this.groupBox3.Controls.Add(this.radioButtonRecovery); 125 | this.groupBox3.Controls.Add(this.radioButtonParsing); 126 | this.groupBox3.Controls.Add(this.radioButtonUsingAPI); 127 | this.groupBox3.Location = new System.Drawing.Point(13, 231); 128 | this.groupBox3.Name = "groupBox3"; 129 | this.groupBox3.Size = new System.Drawing.Size(451, 87); 130 | this.groupBox3.TabIndex = 2; 131 | this.groupBox3.TabStop = false; 132 | this.groupBox3.Text = "Analysis method"; 133 | // 134 | // radioButtonRecovery 135 | // 136 | this.radioButtonRecovery.AutoSize = true; 137 | this.radioButtonRecovery.Location = new System.Drawing.Point(6, 57); 138 | this.radioButtonRecovery.Name = "radioButtonRecovery"; 139 | this.radioButtonRecovery.Size = new System.Drawing.Size(168, 16); 140 | this.radioButtonRecovery.TabIndex = 2; 141 | this.radioButtonRecovery.TabStop = true; 142 | this.radioButtonRecovery.Text = "Recovery deleted records"; 143 | this.radioButtonRecovery.UseVisualStyleBackColor = true; 144 | this.radioButtonRecovery.CheckedChanged += new System.EventHandler(this.radioButtonRecovery_CheckedChanged); 145 | // 146 | // radioButtonParsing 147 | // 148 | this.radioButtonParsing.AutoSize = true; 149 | this.radioButtonParsing.Location = new System.Drawing.Point(239, 25); 150 | this.radioButtonParsing.Name = "radioButtonParsing"; 151 | this.radioButtonParsing.Size = new System.Drawing.Size(156, 16); 152 | this.radioButtonParsing.TabIndex = 1; 153 | this.radioButtonParsing.TabStop = true; 154 | this.radioButtonParsing.Text = "Parsing normal records"; 155 | this.radioButtonParsing.UseVisualStyleBackColor = true; 156 | this.radioButtonParsing.CheckedChanged += new System.EventHandler(this.radioButtonParsing_CheckedChanged); 157 | // 158 | // radioButtonUsingAPI 159 | // 160 | this.radioButtonUsingAPI.AutoSize = true; 161 | this.radioButtonUsingAPI.Location = new System.Drawing.Point(7, 25); 162 | this.radioButtonUsingAPI.Name = "radioButtonUsingAPI"; 163 | this.radioButtonUsingAPI.Size = new System.Drawing.Size(78, 16); 164 | this.radioButtonUsingAPI.TabIndex = 0; 165 | this.radioButtonUsingAPI.TabStop = true; 166 | this.radioButtonUsingAPI.Text = "Using API"; 167 | this.radioButtonUsingAPI.UseVisualStyleBackColor = true; 168 | this.radioButtonUsingAPI.CheckedChanged += new System.EventHandler(this.radioButtonUsingAPI_CheckedChanged); 169 | // 170 | // groupBox4 171 | // 172 | this.groupBox4.Controls.Add(this.comboBoxBrowser); 173 | this.groupBox4.Controls.Add(this.labelFileStatus); 174 | this.groupBox4.Controls.Add(this.buttonFilePath); 175 | this.groupBox4.Controls.Add(this.textBoxFilePath); 176 | this.groupBox4.Location = new System.Drawing.Point(12, 108); 177 | this.groupBox4.Name = "groupBox4"; 178 | this.groupBox4.Size = new System.Drawing.Size(451, 113); 179 | this.groupBox4.TabIndex = 2; 180 | this.groupBox4.TabStop = false; 181 | this.groupBox4.Text = "File path"; 182 | // 183 | // comboBoxBrowser 184 | // 185 | this.comboBoxBrowser.DropDownStyle = System.Windows.Forms.ComboBoxStyle.DropDownList; 186 | this.comboBoxBrowser.FormattingEnabled = true; 187 | this.comboBoxBrowser.Items.AddRange(new object[] { 188 | "Internet Explorer Browser (10 or 11) and Edge"}); 189 | this.comboBoxBrowser.Location = new System.Drawing.Point(7, 21); 190 | this.comboBoxBrowser.Name = "comboBoxBrowser"; 191 | this.comboBoxBrowser.Size = new System.Drawing.Size(438, 20); 192 | this.comboBoxBrowser.TabIndex = 3; 193 | this.comboBoxBrowser.SelectedIndexChanged += new System.EventHandler(this.comboBoxBrowser_SelectedIndexChanged); 194 | // 195 | // labelFileStatus 196 | // 197 | this.labelFileStatus.AutoSize = true; 198 | this.labelFileStatus.ForeColor = System.Drawing.SystemColors.ButtonShadow; 199 | this.labelFileStatus.Location = new System.Drawing.Point(9, 91); 200 | this.labelFileStatus.Name = "labelFileStatus"; 201 | this.labelFileStatus.Size = new System.Drawing.Size(75, 12); 202 | this.labelFileStatus.TabIndex = 2; 203 | this.labelFileStatus.Text = "File status : "; 204 | // 205 | // buttonFilePath 206 | // 207 | this.buttonFilePath.Location = new System.Drawing.Point(403, 57); 208 | this.buttonFilePath.Name = "buttonFilePath"; 209 | this.buttonFilePath.Size = new System.Drawing.Size(42, 23); 210 | this.buttonFilePath.TabIndex = 1; 211 | this.buttonFilePath.Text = "..."; 212 | this.buttonFilePath.UseVisualStyleBackColor = true; 213 | this.buttonFilePath.Click += new System.EventHandler(this.buttonFilePath_Click); 214 | // 215 | // textBoxFilePath 216 | // 217 | this.textBoxFilePath.BackColor = System.Drawing.SystemColors.ButtonHighlight; 218 | this.textBoxFilePath.Location = new System.Drawing.Point(7, 59); 219 | this.textBoxFilePath.Name = "textBoxFilePath"; 220 | this.textBoxFilePath.ReadOnly = true; 221 | this.textBoxFilePath.Size = new System.Drawing.Size(389, 21); 222 | this.textBoxFilePath.TabIndex = 0; 223 | // 224 | // buttonOpen 225 | // 226 | this.buttonOpen.Location = new System.Drawing.Point(304, 402); 227 | this.buttonOpen.Name = "buttonOpen"; 228 | this.buttonOpen.Size = new System.Drawing.Size(75, 23); 229 | this.buttonOpen.TabIndex = 3; 230 | this.buttonOpen.Text = "Open"; 231 | this.buttonOpen.UseVisualStyleBackColor = true; 232 | this.buttonOpen.Click += new System.EventHandler(this.buttonOpen_Click); 233 | // 234 | // buttonCancel 235 | // 236 | this.buttonCancel.Location = new System.Drawing.Point(388, 403); 237 | this.buttonCancel.Name = "buttonCancel"; 238 | this.buttonCancel.Size = new System.Drawing.Size(75, 23); 239 | this.buttonCancel.TabIndex = 4; 240 | this.buttonCancel.Text = "Cancel"; 241 | this.buttonCancel.UseVisualStyleBackColor = true; 242 | this.buttonCancel.Click += new System.EventHandler(this.buttonCancel_Click); 243 | // 244 | // radioButtonCarving 245 | // 246 | this.radioButtonCarving.AutoSize = true; 247 | this.radioButtonCarving.Location = new System.Drawing.Point(239, 57); 248 | this.radioButtonCarving.Name = "radioButtonCarving"; 249 | this.radioButtonCarving.Size = new System.Drawing.Size(113, 16); 250 | this.radioButtonCarving.TabIndex = 3; 251 | this.radioButtonCarving.TabStop = true; 252 | this.radioButtonCarving.Text = "Carving records"; 253 | this.radioButtonCarving.UseVisualStyleBackColor = true; 254 | this.radioButtonCarving.CheckedChanged += new System.EventHandler(this.radioButtonCarving_CheckedChanged); 255 | // 256 | // FormOpen 257 | // 258 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 259 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 260 | this.ClientSize = new System.Drawing.Size(475, 438); 261 | this.Controls.Add(this.buttonCancel); 262 | this.Controls.Add(this.buttonOpen); 263 | this.Controls.Add(this.groupBox4); 264 | this.Controls.Add(this.groupBox3); 265 | this.Controls.Add(this.groupBoxWorking); 266 | this.Controls.Add(this.groupBox1); 267 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.FixedDialog; 268 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 269 | this.MaximizeBox = false; 270 | this.MinimizeBox = false; 271 | this.Name = "FormOpen"; 272 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 273 | this.Text = "Open"; 274 | this.FormClosed += new System.Windows.Forms.FormClosedEventHandler(this.FormOpen_FormClosed); 275 | this.groupBox1.ResumeLayout(false); 276 | this.groupBox1.PerformLayout(); 277 | this.groupBoxWorking.ResumeLayout(false); 278 | this.groupBoxWorking.PerformLayout(); 279 | this.groupBox3.ResumeLayout(false); 280 | this.groupBox3.PerformLayout(); 281 | this.groupBox4.ResumeLayout(false); 282 | this.groupBox4.PerformLayout(); 283 | this.ResumeLayout(false); 284 | 285 | } 286 | 287 | #endregion 288 | 289 | private System.Windows.Forms.GroupBox groupBox1; 290 | private System.Windows.Forms.RadioButton radioButtonOpen; 291 | private System.Windows.Forms.RadioButton radioButtonExtract; 292 | private System.Windows.Forms.GroupBox groupBoxWorking; 293 | private System.Windows.Forms.Button buttonWorkingDirectory; 294 | private System.Windows.Forms.TextBox textBoxWorkingDirectory; 295 | private System.Windows.Forms.GroupBox groupBox3; 296 | private System.Windows.Forms.RadioButton radioButtonRecovery; 297 | private System.Windows.Forms.RadioButton radioButtonParsing; 298 | private System.Windows.Forms.RadioButton radioButtonUsingAPI; 299 | private System.Windows.Forms.GroupBox groupBox4; 300 | private System.Windows.Forms.Label labelFileStatus; 301 | private System.Windows.Forms.Button buttonFilePath; 302 | private System.Windows.Forms.TextBox textBoxFilePath; 303 | private System.Windows.Forms.Button buttonOpen; 304 | private System.Windows.Forms.Button buttonCancel; 305 | private System.Windows.Forms.ComboBox comboBoxBrowser; 306 | private System.Windows.Forms.RadioButton radioButtonCarving; 307 | } 308 | } -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormMain.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace IE10Analyzer 2 | { 3 | partial class FormMain 4 | { 5 | /// 6 | /// 필수 디자이너 변수입니다. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// 사용 중인 모든 리소스를 정리합니다. 12 | /// 13 | /// 관리되는 리소스를 삭제해야 하면 true이고, 그렇지 않으면 false입니다. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form 디자이너에서 생성한 코드 24 | 25 | /// 26 | /// 디자이너 지원에 필요한 메서드입니다. 27 | /// 이 메서드의 내용을 코드 편집기로 수정하지 마십시오. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(FormMain)); 32 | WeifenLuo.WinFormsUI.Docking.DockPanelSkin dockPanelSkin5 = new WeifenLuo.WinFormsUI.Docking.DockPanelSkin(); 33 | WeifenLuo.WinFormsUI.Docking.AutoHideStripSkin autoHideStripSkin5 = new WeifenLuo.WinFormsUI.Docking.AutoHideStripSkin(); 34 | WeifenLuo.WinFormsUI.Docking.DockPanelGradient dockPanelGradient13 = new WeifenLuo.WinFormsUI.Docking.DockPanelGradient(); 35 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient29 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 36 | WeifenLuo.WinFormsUI.Docking.DockPaneStripSkin dockPaneStripSkin5 = new WeifenLuo.WinFormsUI.Docking.DockPaneStripSkin(); 37 | WeifenLuo.WinFormsUI.Docking.DockPaneStripGradient dockPaneStripGradient5 = new WeifenLuo.WinFormsUI.Docking.DockPaneStripGradient(); 38 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient30 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 39 | WeifenLuo.WinFormsUI.Docking.DockPanelGradient dockPanelGradient14 = new WeifenLuo.WinFormsUI.Docking.DockPanelGradient(); 40 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient31 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 41 | WeifenLuo.WinFormsUI.Docking.DockPaneStripToolWindowGradient dockPaneStripToolWindowGradient5 = new WeifenLuo.WinFormsUI.Docking.DockPaneStripToolWindowGradient(); 42 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient32 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 43 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient33 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 44 | WeifenLuo.WinFormsUI.Docking.DockPanelGradient dockPanelGradient15 = new WeifenLuo.WinFormsUI.Docking.DockPanelGradient(); 45 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient34 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 46 | WeifenLuo.WinFormsUI.Docking.TabGradient tabGradient35 = new WeifenLuo.WinFormsUI.Docking.TabGradient(); 47 | this.menuStrip1 = new System.Windows.Forms.MenuStrip(); 48 | this.fileToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 49 | this.openToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 50 | this.exitToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 51 | this.toolToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 52 | this.searchToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 53 | this.exportToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 54 | this.cSVToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 55 | this.sqliteToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 56 | this.helpToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 57 | this.aboutToolStripMenuItem = new System.Windows.Forms.ToolStripMenuItem(); 58 | this.dockPanel = new WeifenLuo.WinFormsUI.Docking.DockPanel(); 59 | this.statusStrip1 = new System.Windows.Forms.StatusStrip(); 60 | this.toolStripStatusLabel = new System.Windows.Forms.ToolStripStatusLabel(); 61 | this.menuStrip1.SuspendLayout(); 62 | this.statusStrip1.SuspendLayout(); 63 | this.SuspendLayout(); 64 | // 65 | // menuStrip1 66 | // 67 | this.menuStrip1.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { 68 | this.fileToolStripMenuItem, 69 | this.toolToolStripMenuItem, 70 | this.helpToolStripMenuItem}); 71 | this.menuStrip1.Location = new System.Drawing.Point(0, 0); 72 | this.menuStrip1.Name = "menuStrip1"; 73 | this.menuStrip1.Size = new System.Drawing.Size(784, 24); 74 | this.menuStrip1.TabIndex = 0; 75 | this.menuStrip1.Text = "menuStrip1"; 76 | // 77 | // fileToolStripMenuItem 78 | // 79 | this.fileToolStripMenuItem.DisplayStyle = System.Windows.Forms.ToolStripItemDisplayStyle.Text; 80 | this.fileToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 81 | this.openToolStripMenuItem, 82 | this.exitToolStripMenuItem}); 83 | this.fileToolStripMenuItem.Name = "fileToolStripMenuItem"; 84 | this.fileToolStripMenuItem.Size = new System.Drawing.Size(37, 20); 85 | this.fileToolStripMenuItem.Text = "File"; 86 | // 87 | // openToolStripMenuItem 88 | // 89 | this.openToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("openToolStripMenuItem.Image"))); 90 | this.openToolStripMenuItem.Name = "openToolStripMenuItem"; 91 | this.openToolStripMenuItem.Size = new System.Drawing.Size(152, 22); 92 | this.openToolStripMenuItem.Text = "Open"; 93 | this.openToolStripMenuItem.Click += new System.EventHandler(this.openToolStripMenuItem_Click); 94 | // 95 | // exitToolStripMenuItem 96 | // 97 | this.exitToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("exitToolStripMenuItem.Image"))); 98 | this.exitToolStripMenuItem.Name = "exitToolStripMenuItem"; 99 | this.exitToolStripMenuItem.Size = new System.Drawing.Size(103, 22); 100 | this.exitToolStripMenuItem.Text = "Exit"; 101 | this.exitToolStripMenuItem.Click += new System.EventHandler(this.exitToolStripMenuItem_Click); 102 | // 103 | // toolToolStripMenuItem 104 | // 105 | this.toolToolStripMenuItem.DisplayStyle = System.Windows.Forms.ToolStripItemDisplayStyle.Text; 106 | this.toolToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 107 | this.searchToolStripMenuItem, 108 | this.exportToolStripMenuItem}); 109 | this.toolToolStripMenuItem.Name = "toolToolStripMenuItem"; 110 | this.toolToolStripMenuItem.Size = new System.Drawing.Size(42, 20); 111 | this.toolToolStripMenuItem.Text = "Tool"; 112 | // 113 | // searchToolStripMenuItem 114 | // 115 | this.searchToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("searchToolStripMenuItem.Image"))); 116 | this.searchToolStripMenuItem.Name = "searchToolStripMenuItem"; 117 | this.searchToolStripMenuItem.Size = new System.Drawing.Size(110, 22); 118 | this.searchToolStripMenuItem.Text = "Search"; 119 | this.searchToolStripMenuItem.Click += new System.EventHandler(this.searchToolStripMenuItem_Click); 120 | // 121 | // exportToolStripMenuItem 122 | // 123 | this.exportToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 124 | this.cSVToolStripMenuItem, 125 | this.sqliteToolStripMenuItem}); 126 | this.exportToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("exportToolStripMenuItem.Image"))); 127 | this.exportToolStripMenuItem.Name = "exportToolStripMenuItem"; 128 | this.exportToolStripMenuItem.Size = new System.Drawing.Size(110, 22); 129 | this.exportToolStripMenuItem.Text = "Export"; 130 | // 131 | // cSVToolStripMenuItem 132 | // 133 | this.cSVToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("cSVToolStripMenuItem.Image"))); 134 | this.cSVToolStripMenuItem.Name = "cSVToolStripMenuItem"; 135 | this.cSVToolStripMenuItem.Size = new System.Drawing.Size(109, 22); 136 | this.cSVToolStripMenuItem.Text = "CSV"; 137 | this.cSVToolStripMenuItem.Click += new System.EventHandler(this.cSVToolStripMenuItem_Click); 138 | // 139 | // sqliteToolStripMenuItem 140 | // 141 | this.sqliteToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("sqliteToolStripMenuItem.Image"))); 142 | this.sqliteToolStripMenuItem.Name = "sqliteToolStripMenuItem"; 143 | this.sqliteToolStripMenuItem.Size = new System.Drawing.Size(109, 22); 144 | this.sqliteToolStripMenuItem.Text = "SQLite"; 145 | this.sqliteToolStripMenuItem.Click += new System.EventHandler(this.sqliteToolStripMenuItem_Click_1); 146 | // 147 | // helpToolStripMenuItem 148 | // 149 | this.helpToolStripMenuItem.DisplayStyle = System.Windows.Forms.ToolStripItemDisplayStyle.Text; 150 | this.helpToolStripMenuItem.DropDownItems.AddRange(new System.Windows.Forms.ToolStripItem[] { 151 | this.aboutToolStripMenuItem}); 152 | this.helpToolStripMenuItem.Name = "helpToolStripMenuItem"; 153 | this.helpToolStripMenuItem.Size = new System.Drawing.Size(44, 20); 154 | this.helpToolStripMenuItem.Text = "Help"; 155 | // 156 | // aboutToolStripMenuItem 157 | // 158 | this.aboutToolStripMenuItem.Image = ((System.Drawing.Image)(resources.GetObject("aboutToolStripMenuItem.Image"))); 159 | this.aboutToolStripMenuItem.Name = "aboutToolStripMenuItem"; 160 | this.aboutToolStripMenuItem.Size = new System.Drawing.Size(107, 22); 161 | this.aboutToolStripMenuItem.Text = "About"; 162 | this.aboutToolStripMenuItem.Click += new System.EventHandler(this.aboutToolStripMenuItem_Click); 163 | // 164 | // dockPanel 165 | // 166 | this.dockPanel.Dock = System.Windows.Forms.DockStyle.Fill; 167 | this.dockPanel.Location = new System.Drawing.Point(0, 24); 168 | this.dockPanel.Name = "dockPanel"; 169 | this.dockPanel.Size = new System.Drawing.Size(784, 538); 170 | dockPanelGradient13.EndColor = System.Drawing.SystemColors.ControlLight; 171 | dockPanelGradient13.StartColor = System.Drawing.SystemColors.ControlLight; 172 | autoHideStripSkin5.DockStripGradient = dockPanelGradient13; 173 | tabGradient29.EndColor = System.Drawing.SystemColors.Control; 174 | tabGradient29.StartColor = System.Drawing.SystemColors.Control; 175 | tabGradient29.TextColor = System.Drawing.SystemColors.ControlDarkDark; 176 | autoHideStripSkin5.TabGradient = tabGradient29; 177 | autoHideStripSkin5.TextFont = new System.Drawing.Font("맑은 고딕", 9F); 178 | dockPanelSkin5.AutoHideStripSkin = autoHideStripSkin5; 179 | tabGradient30.EndColor = System.Drawing.SystemColors.ControlLightLight; 180 | tabGradient30.StartColor = System.Drawing.SystemColors.ControlLightLight; 181 | tabGradient30.TextColor = System.Drawing.SystemColors.ControlText; 182 | dockPaneStripGradient5.ActiveTabGradient = tabGradient30; 183 | dockPanelGradient14.EndColor = System.Drawing.SystemColors.Control; 184 | dockPanelGradient14.StartColor = System.Drawing.SystemColors.Control; 185 | dockPaneStripGradient5.DockStripGradient = dockPanelGradient14; 186 | tabGradient31.EndColor = System.Drawing.SystemColors.ControlLight; 187 | tabGradient31.StartColor = System.Drawing.SystemColors.ControlLight; 188 | tabGradient31.TextColor = System.Drawing.SystemColors.ControlText; 189 | dockPaneStripGradient5.InactiveTabGradient = tabGradient31; 190 | dockPaneStripSkin5.DocumentGradient = dockPaneStripGradient5; 191 | dockPaneStripSkin5.TextFont = new System.Drawing.Font("맑은 고딕", 9F); 192 | tabGradient32.EndColor = System.Drawing.SystemColors.ActiveCaption; 193 | tabGradient32.LinearGradientMode = System.Drawing.Drawing2D.LinearGradientMode.Vertical; 194 | tabGradient32.StartColor = System.Drawing.SystemColors.GradientActiveCaption; 195 | tabGradient32.TextColor = System.Drawing.SystemColors.ActiveCaptionText; 196 | dockPaneStripToolWindowGradient5.ActiveCaptionGradient = tabGradient32; 197 | tabGradient33.EndColor = System.Drawing.SystemColors.Control; 198 | tabGradient33.StartColor = System.Drawing.SystemColors.Control; 199 | tabGradient33.TextColor = System.Drawing.SystemColors.ControlText; 200 | dockPaneStripToolWindowGradient5.ActiveTabGradient = tabGradient33; 201 | dockPanelGradient15.EndColor = System.Drawing.SystemColors.ControlLight; 202 | dockPanelGradient15.StartColor = System.Drawing.SystemColors.ControlLight; 203 | dockPaneStripToolWindowGradient5.DockStripGradient = dockPanelGradient15; 204 | tabGradient34.EndColor = System.Drawing.SystemColors.InactiveCaption; 205 | tabGradient34.LinearGradientMode = System.Drawing.Drawing2D.LinearGradientMode.Vertical; 206 | tabGradient34.StartColor = System.Drawing.SystemColors.GradientInactiveCaption; 207 | tabGradient34.TextColor = System.Drawing.SystemColors.InactiveCaptionText; 208 | dockPaneStripToolWindowGradient5.InactiveCaptionGradient = tabGradient34; 209 | tabGradient35.EndColor = System.Drawing.Color.Transparent; 210 | tabGradient35.StartColor = System.Drawing.Color.Transparent; 211 | tabGradient35.TextColor = System.Drawing.SystemColors.ControlDarkDark; 212 | dockPaneStripToolWindowGradient5.InactiveTabGradient = tabGradient35; 213 | dockPaneStripSkin5.ToolWindowGradient = dockPaneStripToolWindowGradient5; 214 | dockPanelSkin5.DockPaneStripSkin = dockPaneStripSkin5; 215 | this.dockPanel.Skin = dockPanelSkin5; 216 | this.dockPanel.TabIndex = 3; 217 | this.dockPanel.ActiveDocumentChanged += new System.EventHandler(this.dockPanel_ActiveDocumentChanged); 218 | // 219 | // statusStrip1 220 | // 221 | this.statusStrip1.Items.AddRange(new System.Windows.Forms.ToolStripItem[] { 222 | this.toolStripStatusLabel}); 223 | this.statusStrip1.Location = new System.Drawing.Point(0, 540); 224 | this.statusStrip1.Name = "statusStrip1"; 225 | this.statusStrip1.Size = new System.Drawing.Size(784, 22); 226 | this.statusStrip1.TabIndex = 6; 227 | this.statusStrip1.Text = "statusStrip1"; 228 | // 229 | // toolStripStatusLabel 230 | // 231 | this.toolStripStatusLabel.IsLink = true; 232 | this.toolStripStatusLabel.Name = "toolStripStatusLabel"; 233 | this.toolStripStatusLabel.Size = new System.Drawing.Size(769, 17); 234 | this.toolStripStatusLabel.Spring = true; 235 | this.toolStripStatusLabel.Text = "Jeonghyeon Kim, http://moaistory.blogspot.com"; 236 | this.toolStripStatusLabel.TextAlign = System.Drawing.ContentAlignment.MiddleRight; 237 | this.toolStripStatusLabel.Click += new System.EventHandler(this.toolStripStatusLabel_Click); 238 | // 239 | // FormMain 240 | // 241 | this.AllowDrop = true; 242 | this.AutoScaleDimensions = new System.Drawing.SizeF(7F, 12F); 243 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 244 | this.ClientSize = new System.Drawing.Size(784, 562); 245 | this.Controls.Add(this.statusStrip1); 246 | this.Controls.Add(this.dockPanel); 247 | this.Controls.Add(this.menuStrip1); 248 | this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon"))); 249 | this.IsMdiContainer = true; 250 | this.MainMenuStrip = this.menuStrip1; 251 | this.Name = "FormMain"; 252 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterScreen; 253 | this.Text = "IE10Analyzer"; 254 | this.FormClosing += new System.Windows.Forms.FormClosingEventHandler(this.FormMain_FormClosing); 255 | this.Load += new System.EventHandler(this.FormMain_Load); 256 | this.ResizeEnd += new System.EventHandler(this.FormMain_ResizeEnd); 257 | this.DragDrop += new System.Windows.Forms.DragEventHandler(this.FormMain_DragDrop); 258 | this.DragEnter += new System.Windows.Forms.DragEventHandler(this.FormMain_DragEnter); 259 | this.menuStrip1.ResumeLayout(false); 260 | this.menuStrip1.PerformLayout(); 261 | this.statusStrip1.ResumeLayout(false); 262 | this.statusStrip1.PerformLayout(); 263 | this.ResumeLayout(false); 264 | this.PerformLayout(); 265 | 266 | } 267 | 268 | #endregion 269 | 270 | private System.Windows.Forms.MenuStrip menuStrip1; 271 | private System.Windows.Forms.ToolStripMenuItem fileToolStripMenuItem; 272 | private System.Windows.Forms.ToolStripMenuItem exitToolStripMenuItem; 273 | private System.Windows.Forms.ToolStripMenuItem helpToolStripMenuItem; 274 | private System.Windows.Forms.ToolStripMenuItem aboutToolStripMenuItem; 275 | private System.Windows.Forms.ToolStripMenuItem toolToolStripMenuItem; 276 | private WeifenLuo.WinFormsUI.Docking.DockPanel dockPanel; 277 | private System.Windows.Forms.ToolStripMenuItem searchToolStripMenuItem; 278 | private System.Windows.Forms.ToolStripMenuItem exportToolStripMenuItem; 279 | private System.Windows.Forms.ToolStripMenuItem cSVToolStripMenuItem; 280 | private System.Windows.Forms.ToolStripMenuItem sqliteToolStripMenuItem; 281 | private System.Windows.Forms.ToolStripMenuItem openToolStripMenuItem; 282 | private System.Windows.Forms.StatusStrip statusStrip1; 283 | private System.Windows.Forms.ToolStripStatusLabel toolStripStatusLabel; 284 | } 285 | } 286 | 287 | -------------------------------------------------------------------------------- /IE10Analyzer/IEForensic/FormOpen.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Windows.Forms; 9 | using System.IO; 10 | using System.Reflection; 11 | using System.Runtime.InteropServices; 12 | using System.Diagnostics; 13 | using System.Management; 14 | 15 | namespace IE10Analyzer 16 | { 17 | 18 | public partial class FormOpen : Form 19 | { 20 | //[DllImport("ExtractFiles.dll", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Unicode)] 21 | //public static extern bool FileCopy([MarshalAs(UnmanagedType.LPWStr)]String lpSrcName, [MarshalAs(UnmanagedType.LPWStr)]String lpDstName); 22 | [UnmanagedFunctionPointer(CallingConvention.Cdecl)] 23 | private delegate bool FileCopy([MarshalAs(UnmanagedType.LPWStr)]String lpSrcName, [MarshalAs(UnmanagedType.LPWStr)]String lpDstName); 24 | 25 | [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)] 26 | static extern IntPtr LoadLibrary([MarshalAs(UnmanagedType.LPStr)]string lpFileName); 27 | 28 | [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] 29 | static extern IntPtr GetProcAddress(IntPtr hModule, string procName); 30 | 31 | [DllImport("kernel32", SetLastError = true)] 32 | static extern bool FreeLibrary(IntPtr hModule); 33 | 34 | private String filePath = ""; 35 | private String workingDirectory = ""; 36 | private BackgroundWorker backgroudWoker; 37 | private FormWait formWait; 38 | private FormMain formMain; 39 | public FormOpen(FormMain formMain) 40 | { 41 | 42 | InitializeComponent(); 43 | this.formMain = formMain; 44 | comboBoxBrowser.SelectedIndex = 0; 45 | } 46 | 47 | public bool fileOpen(string path) 48 | { 49 | try 50 | { 51 | HexReader hexReader = new HexReader(path); 52 | long signature = hexReader.readLong(4); 53 | if (signature != 6736818458095L) 54 | { 55 | MessageBox.Show("Please open the correct file", "This file is not ESE database", MessageBoxButtons.OK, MessageBoxIcon.Error); 56 | this.filePath = ""; 57 | this.textBoxFilePath.Text = this.filePath; 58 | hexReader.close(); 59 | return false ; 60 | } 61 | this.filePath = path; 62 | this.textBoxFilePath.Text = this.filePath; 63 | int status = hexReader.readInt(0x34); 64 | if (status == 2) 65 | { 66 | this.labelFileStatus.Text = "File status : Dirty"; 67 | radioButtonUsingAPI.Enabled = false; 68 | radioButtonParsing.Checked = true; 69 | } 70 | else 71 | { 72 | this.labelFileStatus.Text = "File status : Clean"; 73 | radioButtonUsingAPI.Enabled = true; 74 | radioButtonUsingAPI.Checked = true; 75 | DateTime currTime = DateTime.Now; 76 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 77 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 78 | textBoxWorkingDirectory.Text = workingDirectory; 79 | 80 | } 81 | 82 | 83 | hexReader.close(); 84 | return true; 85 | } 86 | catch 87 | { 88 | MessageBox.Show("Can not open the file", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 89 | return false; 90 | } 91 | } 92 | 93 | private void buttonFilePath_Click(object sender, EventArgs e) 94 | { 95 | OpenFileDialog open = new OpenFileDialog(); 96 | open.Title = "Select ESE database file"; 97 | 98 | 99 | if (open.ShowDialog() == DialogResult.OK) 100 | { 101 | fileOpen(open.FileName); 102 | } 103 | } 104 | 105 | private void radioButtonExtract_CheckedChanged(object sender, EventArgs e) 106 | { 107 | if (radioButtonExtract.Checked == true) 108 | { 109 | buttonFilePath.Enabled = false; 110 | comboBoxBrowser.Enabled = true; 111 | comboBoxBrowser.SelectedIndex = 0; 112 | this.filePath = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + @"\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"; 113 | if (!File.Exists(this.filePath)) 114 | { 115 | MessageBox.Show("Internet Explorer 10 later version or Edge browser is not installed", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 116 | this.radioButtonOpen.Checked = true; 117 | } 118 | else 119 | { 120 | this.textBoxFilePath.Text = this.filePath; 121 | this.labelFileStatus.Text = "File status : Dirty"; 122 | radioButtonUsingAPI.Enabled = false; 123 | radioButtonParsing.Checked = true; 124 | buttonWorkingDirectory.Enabled = true; 125 | DateTime currTime = DateTime.Now; 126 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 127 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 128 | textBoxWorkingDirectory.Text = workingDirectory; 129 | groupBoxWorking.Text = "Working directory and extracted file name"; 130 | } 131 | } 132 | } 133 | 134 | public void radioButtonOpen_Check() 135 | { 136 | radioButtonOpen.Checked = true; 137 | } 138 | 139 | private void radioButtonOpen_CheckedChanged(object sender, EventArgs e) 140 | { 141 | if (radioButtonOpen.Checked == true) 142 | { 143 | this.filePath = ""; 144 | this.textBoxFilePath.Text = this.filePath; 145 | this.labelFileStatus.Text = "File status :"; 146 | buttonFilePath.Enabled = true; 147 | radioButtonUsingAPI.Enabled = true; 148 | radioButtonUsingAPI.Checked = true; 149 | buttonWorkingDirectory.Enabled = true; 150 | comboBoxBrowser.Enabled = false; 151 | groupBoxWorking.Text = "Working directory and copied file name"; 152 | } 153 | } 154 | 155 | private void radioButtonParsing_CheckedChanged(object sender, EventArgs e) 156 | { 157 | if (radioButtonParsing.Checked == true) 158 | { 159 | if (radioButtonOpen.Checked) 160 | { 161 | buttonWorkingDirectory.Enabled = false; 162 | textBoxWorkingDirectory.Text = ""; 163 | this.workingDirectory = ""; 164 | } 165 | else 166 | { 167 | buttonWorkingDirectory.Enabled = true; 168 | DateTime currTime = DateTime.Now; 169 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 170 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 171 | textBoxWorkingDirectory.Text = workingDirectory; 172 | } 173 | } 174 | } 175 | 176 | private void radioButtonRecovery_CheckedChanged(object sender, EventArgs e) 177 | { 178 | if (radioButtonRecovery.Checked == true) 179 | { 180 | if (radioButtonOpen.Checked) 181 | { 182 | buttonWorkingDirectory.Enabled = false; 183 | textBoxWorkingDirectory.Text = ""; 184 | this.workingDirectory = ""; 185 | } 186 | else 187 | { 188 | buttonWorkingDirectory.Enabled = true; 189 | DateTime currTime = DateTime.Now; 190 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 191 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 192 | textBoxWorkingDirectory.Text = workingDirectory; 193 | } 194 | } 195 | 196 | } 197 | 198 | private void radioButtonCarving_CheckedChanged(object sender, EventArgs e) 199 | { 200 | if (radioButtonCarving.Checked == true) 201 | { 202 | if (radioButtonOpen.Checked) 203 | { 204 | buttonWorkingDirectory.Enabled = false; 205 | textBoxWorkingDirectory.Text = ""; 206 | this.workingDirectory = ""; 207 | } 208 | else 209 | { 210 | buttonWorkingDirectory.Enabled = true; 211 | DateTime currTime = DateTime.Now; 212 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 213 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 214 | textBoxWorkingDirectory.Text = workingDirectory; 215 | } 216 | } 217 | 218 | } 219 | private void radioButtonUsingAPI_CheckedChanged(object sender, EventArgs e) 220 | { 221 | if (radioButtonUsingAPI.Checked == true) 222 | { 223 | if (radioButtonOpen.Checked) 224 | { 225 | buttonWorkingDirectory.Enabled = true; 226 | DateTime currTime = DateTime.Now; 227 | String time = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss"); 228 | workingDirectory = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text); 229 | textBoxWorkingDirectory.Text = workingDirectory; 230 | } 231 | else 232 | { 233 | buttonWorkingDirectory.Enabled = false; 234 | textBoxWorkingDirectory.Text = ""; 235 | this.workingDirectory = ""; 236 | } 237 | } 238 | } 239 | 240 | private void buttonWorkingDirectory_Click(object sender, EventArgs e) 241 | { 242 | SaveFileDialog sf = new SaveFileDialog(); 243 | 244 | sf.FileName = Path.GetFileName(textBoxFilePath.Text); 245 | 246 | if (sf.ShowDialog() == DialogResult.OK) 247 | { 248 | this.workingDirectory = sf.FileName; 249 | textBoxWorkingDirectory.Text = this.workingDirectory; 250 | if (File.Exists(workingDirectory)) 251 | { 252 | File.Delete(workingDirectory); 253 | } 254 | } 255 | } 256 | 257 | private void buttonCancel_Click(object sender, EventArgs e) 258 | { 259 | this.Close(); 260 | } 261 | 262 | private void extractFile() 263 | { 264 | formWait = new FormWait(); 265 | formWait.setLabel("extracting file"); 266 | formWait.FormClosing += new FormClosingEventHandler(waitFormClosingEventHandler); 267 | formWait.setStyle(ProgressBarStyle.Marquee); 268 | formWait.end(""); 269 | backgroudWoker = new BackgroundWorker(); 270 | backgroudWoker.DoWork += new DoWorkEventHandler(extractFileDoWork); 271 | backgroudWoker.RunWorkerCompleted += new RunWorkerCompletedEventHandler(extractFileRunWorkerCompletedEventHandler); 272 | backgroudWoker.WorkerSupportsCancellation = true; 273 | backgroudWoker.RunWorkerAsync(); 274 | formWait.ShowDialog(); 275 | } 276 | 277 | private void analyzeFile() 278 | { 279 | this.Visible = false; 280 | if (radioButtonUsingAPI.Checked == true) 281 | { 282 | Directory.CreateDirectory(Path.GetDirectoryName(workingDirectory)); 283 | formMain.openAPI(this.filePath, this.workingDirectory); 284 | } 285 | else if (radioButtonParsing.Checked == true) 286 | { 287 | if (radioButtonExtract.Checked) 288 | { 289 | formMain.openParsing(this.workingDirectory); 290 | } 291 | else 292 | { 293 | formMain.openParsing(this.filePath); 294 | } 295 | } 296 | else if (radioButtonRecovery.Checked == true) 297 | { 298 | if (radioButtonExtract.Checked) 299 | { 300 | formMain.openRecovery(this.workingDirectory); 301 | } 302 | else 303 | { 304 | formMain.openRecovery(this.filePath); 305 | } 306 | } 307 | else if (radioButtonCarving.Checked == true) 308 | { 309 | if (radioButtonExtract.Checked) 310 | { 311 | formMain.openCaving(this.workingDirectory); 312 | } 313 | else 314 | { 315 | formMain.openCaving(this.filePath); 316 | } 317 | } 318 | this.Close(); 319 | } 320 | 321 | 322 | 323 | public void extractFileDoWork(object sender, DoWorkEventArgs e) 324 | { 325 | Directory.CreateDirectory(Path.GetDirectoryName(workingDirectory)); 326 | if (!File.Exists("ExtractFiles.dll")) 327 | { 328 | using (Stream input = Assembly.GetExecutingAssembly().GetManifestResourceStream("IEForensic.Resources.ExtractFiles.dll")) 329 | using (Stream output = File.Create("ExtractFiles.dll")) 330 | { 331 | byte[] buffer = new byte[8192]; 332 | 333 | int bytesRead; 334 | while ((bytesRead = input.Read(buffer, 0, buffer.Length)) > 0) 335 | { 336 | output.Write(buffer, 0, bytesRead); 337 | } 338 | } 339 | } 340 | 341 | IntPtr hLib = LoadLibrary("ExtractFiles.dll"); 342 | IntPtr ctorPtr = GetProcAddress(hLib, "FileCopy"); 343 | FileCopy constructorFn = (FileCopy)Marshal.GetDelegateForFunctionPointer(ctorPtr, typeof(FileCopy)); 344 | bool result = constructorFn(filePath, workingDirectory); 345 | FreeLibrary(hLib); 346 | 347 | if (File.Exists("ExtractFiles.dll")) 348 | { 349 | File.Delete("ExtractFiles.dll"); 350 | } 351 | e.Result = result; 352 | } 353 | 354 | public void waitFormClosingEventHandler(object sender, FormClosingEventArgs e) 355 | { 356 | if (e.CloseReason == CloseReason.UserClosing) 357 | { 358 | Process[] processList = Process.GetProcessesByName("ExtractFile"); 359 | if (processList.Length > 0) 360 | { 361 | foreach (Process process in processList) 362 | { 363 | process.Kill(); 364 | } 365 | MessageBox.Show("Cancel extracting file", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 366 | } 367 | } 368 | 369 | } 370 | 371 | public void extractFileRunWorkerCompletedEventHandler(object sender, RunWorkerCompletedEventArgs e) 372 | { 373 | bool result = (bool)e.Result; 374 | formWait.Visible = false; 375 | formWait.Close(); 376 | 377 | if (result == false) 378 | { 379 | MessageBox.Show("Cannot extract file, Run this program as an administrator", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 380 | } 381 | else 382 | { 383 | analyzeFile(); 384 | } 385 | 386 | } 387 | 388 | private void buttonOpen_Click(object sender, EventArgs e) 389 | { 390 | if (textBoxFilePath.Text.Length == 0) 391 | { 392 | MessageBox.Show("File path is blank", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 393 | return; 394 | } 395 | if (!File.Exists(textBoxFilePath.Text)) 396 | { 397 | MessageBox.Show("File does not exist", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error); 398 | return; 399 | } 400 | if (radioButtonExtract.Checked == true) 401 | { 402 | extractFile(); 403 | } 404 | else 405 | { 406 | analyzeFile(); 407 | } 408 | 409 | } 410 | 411 | private void comboBoxBrowser_SelectedIndexChanged(object sender, EventArgs e) 412 | { 413 | if (comboBoxBrowser.SelectedIndex == 0) 414 | { 415 | this.filePath = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + @"\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"; 416 | } 417 | else 418 | { 419 | this.filePath = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) + @"\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat"; 420 | } 421 | this.textBoxFilePath.Text = this.filePath; 422 | } 423 | 424 | private void FormOpen_FormClosed(object sender, FormClosedEventArgs e) 425 | { 426 | 427 | } 428 | protected override bool ProcessCmdKey(ref Message msg, Keys keyData) 429 | { 430 | if (keyData == (Keys.Escape)) 431 | { 432 | this.Close(); 433 | return true; 434 | } 435 | return base.ProcessCmdKey(ref msg, keyData); 436 | } 437 | 438 | 439 | } 440 | } 441 | --------------------------------------------------------------------------------