aftermath
aftermath copied to clipboard
Question - Browser Triage
Hi there,
Thanks for this tool. I have a couple quick questions around web browser triage.
I see that, by default, it force kills browsers so as to remove database locks. I also see that it is possible to disable this functionality.
- I presume that if browser killing is disabled, that the triage simply does not collect browser information?
- I am sure there is a reason why this is not implemented, but has it been considered to simply create a copy of the database file(s), and use those copies for triage? For example, if I have Firefox open, I cannot open
places.sqlite, but I very much so can just create a copy of the file and open that up.