|Screenshot stored by FoxTab|
The images displayed using the Tab Flipper feature (depicting the currently opened tabs) are stored in a folder titled "thumbs" within a user's AppData\Local\Temp\foxtab directory (or Local Settings\Temp\foxtab on XP). For each tab that is opened in Firefox, a screenshot of the webpage depicted in the tab is stored for use in navigating between currently opened tabs using the Foxtab interface. While newer versions of FoxTab appear to delete the screenshots in the foxtab\thumbs folder when Firefox is closed, older versions (1.4.2 and earlier) of FoxTab aren't quite as efficient in cleaning up their mess. When testing this feature, I observed on several occasions files remaining in the foxtab\thumbs directory after closing Firefox. The remaining files could simply be given a .jpg or .png extension (they are stored without an extension) and viewed using the native Windows photo viewer.
Based on my testing thus far, the $STANDARD_INFORMATION creation date of the files within the foxtab\thumbs folder correspond with the time in which the webpage depicted in the screenshot was first visited. The $STANDARD_INFORMATION last modified time appears to be a close approximation of the time the webpage was first visited, although it's a few seconds after the creation date. I haven't pinned down exactly what the variance can be attributed to, but in all tests, the last modified time of each file was within 40 seconds of the creation time (although some were as close as four seconds apart).
The images displayed using the Recently Closed Tabs feature are stored in a folder titled "thumbsRCT" within a user's AppData\Local\Temp\foxtab folder (or Local Settings\Temp\foxtab on XP). Similar to the foxtab\thumbs folder, this directory stores images of tabs that were opened in Firefox at some point. Within the FoxTab interface, a user may view a graphical depiction of the recently closed tabs. My testing has indicated that only those tabs that were closed since Firefox was last opened are available, despite the fact that screenshots from previous browsing sessions may very well still be stored in the foxtab\thumbsRCT folder.
|Recently Closed Tab Feature of FoxTab|
Based on my testing thus far, it appears that the $STANDARD_INFORMATION last modified date of each file in the foxtab\thumbsRCT folder corresponds to the approximate time in which the webpage depicted in the screenshot was opened (this is the same last modified time of the file when stored in the foxtab\thumbs directory). The $STANDARD_INFORMATION creation date of each file appears to correspond with the time in which the Firefox tab containing the depicted webpage was closed (and hence the screenshot was added to the "thumbsRCT" folder). If the $STANDARD_INFORMATION timestamps can be trusted in a particular case, the creation and last modified time of files in the foxtab\thumbsRCT folder may provide a time frame in which the webpage depicted in the screenshot was open in the user's browser.
Forensic Implications of FoxTab
Although the artifacts left behind by FoxTab do not seem to store the URL of the webpage depicted in each screenshot, an examiner is provided with a visual depiction of the webpage as the user would have viewed it. This can be very telling in cases involving access to illicit websites where the relevant browsing history of the computer is no longer available.
It seems that clearing the Firefox browsing history does not have an effect on the files saved by FoxTab, as they are stored independently of the browsing history and cache files. Additionally, uninstalling the FoxTab add-on does not seem to remove either the foxtab\thumbs or foxtab\thumbsRCT directory. Further, utilizing Firefox's InPrivate browsing mode does not seem to have an effect on the functionality of FoxTab. It appears that unless the foxtab directories themselves are deleted, many screenshots from previous browsing sessions, both standard and InPrivate, may remain on disk.
Overall, if FoxTab is functioning correctly, it will save screenshots of currently opened tabs and tabs that were closed since Firefox was last opened. Older versions of FoxTab (1.4.2 and earlier) remove screenshots less frequently (if at all) than newer versions, however, even the most current version (1.4.5) does not seem to remove all screenshots. This means that a visual depiction of many webpages visited by the user may potentially be available in the foxtab directories previously described, regardless of whether a user deleted their browsing history or utilized the InPrivate browsing mode of Firefox. While the absence of the page URL is certainly a drawback, the artifacts left behind by FoxTab may provide insight into a user's browsing history where it would otherwise be unavailable.