Friday, May 28, 2010

Opera browser does not erase all the tracks while clearing history

People who use opera, just be(a)ware!

Clearing the history completely does not erase all the readily available tracks. Opera caches the site icons from almost every visited site and it remains on the system forever!

Clearing the history and deleting all the cookies does not clear these files.

Check it out yourselves if using opera.

In a normal desktop installation of the opera browser, the favicon files cache is available at "C:\Documents and Settings\\Local Settings\Application Data\Opera\Opera\icons" folder. This is applicable for Windows XP Operating systems and for Windows 7 this folder location will be different. The folder can be easily accessed using "%HOMEFOLDER%\Local Settings\Application Data\Opera\Opera\icons\" string typed at the RUN dialog box. If the folder cannot be located, type, opera:config#UserPrefs

OperaDirectory which will contain the location of the User Preferences directory for the opera installation.
 
The folder contains the http location and favicon files of almost all the sites ever visited by a user. If not to get a glimpse of the history or for forensic purposes, the folder can be looked at to know when the user has visited a particular website. Though there is no way of telling if the user has visited a site more than once, but at least one can clearly get a list of visited websites. This is of great help while performing forensics.

The above is applicable to Opera browser v9.x and above.

1 comment: