WEBVTT

00:00:02.145 --> 00:00:04.635 align:middle line:90%
Word to the wise--

00:00:04.635 --> 00:00:08.025 align:middle line:84%
if you come across
uncommon browsers

00:00:08.025 --> 00:00:11.655 align:middle line:84%
that you're not used to,
hunt for the databases first.

00:00:11.655 --> 00:00:15.195 align:middle line:84%
Make sure the databases
are properly decoding.

00:00:15.195 --> 00:00:17.265 align:middle line:84%
So even if it's not
parsed, if you're looking,

00:00:17.265 --> 00:00:21.105 align:middle line:84%
if you see base64, or maybe you
see some kind of encryption,

00:00:21.105 --> 00:00:23.295 align:middle line:90%
can you decrypt it or decode it?

00:00:23.295 --> 00:00:25.245 align:middle line:84%
Just because one table
is encrypted doesn't

00:00:25.245 --> 00:00:26.445 align:middle line:90%
mean all of them will be.

00:00:26.445 --> 00:00:28.425 align:middle line:90%
Same thing with the databases.

00:00:28.425 --> 00:00:31.210 align:middle line:84%
If the database is encrypted,
what about the write ahead log?

00:00:31.210 --> 00:00:32.085 align:middle line:90%
Can you look at that?

00:00:32.085 --> 00:00:34.445 align:middle line:90%
Can you look at the cache files?

00:00:34.445 --> 00:00:40.265 align:middle line:84%
Can you find bookmarks,
browser history, downloads,

00:00:40.265 --> 00:00:41.405 align:middle line:90%
all of these things?

00:00:41.405 --> 00:00:45.275 align:middle line:84%
If it's secure browsing
or done in private mode,

00:00:45.275 --> 00:00:46.805 align:middle line:90%
look for cookies.

00:00:46.805 --> 00:00:48.695 align:middle line:84%
Look for bookmarks
and downloads.

00:00:48.695 --> 00:00:51.155 align:middle line:84%
Bookmarks and downloads that
you do in private browsing

00:00:51.155 --> 00:00:53.885 align:middle line:84%
are saved with your normal
bookmarks and downloads

00:00:53.885 --> 00:00:54.905 align:middle line:90%
for those browsers.

00:00:54.905 --> 00:00:56.765 align:middle line:90%
Most people don't realize that.

00:00:56.765 --> 00:01:00.635 align:middle line:84%
And look for the tabs
because if we crash,

00:01:00.635 --> 00:01:03.455 align:middle line:84%
your browser wants to
remind you where you were.