Ucwaningo lwe-forensics lwedijithali seluyinto ebalulekile kunoma iyiphi Ithimba lezokuphepha le-IT elifuna ukuphenya izehlakalo zesiphequluliFuthi, ikakhulukazi, ku FirefoxUkuqonda ukuthi amaseshini abasebenzisi, imilando, namaphrofayela agcinwa kanjani, asulwe futhi akhiwe kabusha akusizi nje kuphela ekubambeni izigebengu ze-inthanethi; kubalulekile futhi ekufundeni ukuthi yini engahambanga kahle, ukuthuthukisa ukuzivikela, kanye nokubhala phansi ubufakazi obuqinile obungamelana nezinqubo zomthetho.
Uma ukhuluma ngakho Iseshini yeFirefox kanye namasu okubuyisa ulwazi lwephrofayiliAsikhulumi ngohlelo olulodwa lomlingo, kodwa kunalokho isethi yezinqubo ezicophelelayo: ukulondoloza ubufakazi, ukuhlanganisa amadiski, ukuhlaziya izinhlelo zamafayela, ukukhipha idatha ku-RAM, ukwakha kabusha umsebenzi wokuphequlula, ukuyihlanganisa namalogi enethiwekhi, kanye, nemibhalo ye-forensic. Konke lokhu kusekelwa amasudi namathuluzi wamahhala nawezentengiselwano. Uma kusetshenziswa kahle, lokhu kuvumela amaqembu okuphepha kwe-IT ukuthi adlule kakhulu kunokuthi "Ngihlole umlando."
Izisekelo ze-forensics yekhompyutha ezisetshenziswa ku-Firefox
Ngaphambi kokungena kumaphrofayili eFirefox, kubalulekile ukuqonda ngokucacile ukuthi iyini iphrofayili. Ukuhlolwa kwe-forensics kwedijithali nokuthi kungani ukulondolozwa kubalulekileI-forensics yedijithali ihilela ukukhipha ulwazi kumadiski, amadivayisi ememori, nakwezinye izinto zokugcina ngaphandle kokushintsha isimo sazo. Uchungechunge lokugcinwa luhlala lugcinwa ukuqinisekisa ukuthi idatha etholakele iyamukeleka futhi ithembekile.
Ekuphenyweni lapho iFirefox igxile khona, uchwepheshe uqala ngokuthi ukutholakala kwedatha nokugcinwa kwayoUkwenziwa kwe-bit-by-bit kwediski (noma ivolumu lapho amaphrofayili ekhona), ukukopisha kusuka kwabezindaba zangaphandle, futhi ezimweni eziningi, ukulahla i-RAM. Umgomo uwukusebenza njalo kumakhophi e-forensic, hhayi kowokuqala. Lokhu kugwema ukubhubhisa imikhondo ebucayi njengezikhathi ezivulekile, amakhukhi asebenzayo, noma umlando wokuphequlula ogciniwe.
Uma ubufakazi sebuqinisekisiwe, isigaba esilandelayo siyaqala Ukuhlaziywa okujulile kwamafayela, izingodo, kanye nezinto zobuciko zesiphequluliKuleli qophelo, izinhlelo zamafayela, izizindalwazi zangaphakathi zeFirefox (i-SQLite), amafayela eseshini, amafayela okucushwa, amalogi esistimu yokusebenza, nanoma yimuphi umkhondo ongabonisa umsebenzi wangempela womsebenzisi kuyabuyekezwa: ukuthi yimaphi amawebhusayithi awavakashele, ngasiphi isikhathi, yiziphi izandiso, ukuthi ngabe asuse umlando wawo, njll.
Kubalulekile ukuqonda ukuthi ukuhlaziywa kwe-forensic akugcini nje kwi-PC. Iphinde ihlanganise ithrafikhi yenethiwekhi kanye namanye amadivayisi ahilelekile. Uma iseshini yeFirefox isetshenziswe ukufinyelela izinsizakalo zamafu, amanethiwekhi omphakathi, noma izinhlelo zezinkampani, ulwazi lwendawo kuzodingeka lubhekwe ngokuhlanganisa ukuthwebula kwenethiwekhi, amalogi eseva, kanye, uma kusebenza, nobufakazi obugcinwe efwini.
Amaseshini namaphrofayili eFirefox: yini engatholakala kabusha
I-Firefox ihlela ulwazi lomsebenzisi ngamunye lube Amaphrofayili azimele ahlanganisa umlando, amakhukhi, amaphasiwedi, izikhathi, kanye nezilungiseleloNgokombono we-forensic, lokhu kuyigolide elicwengekile, ngoba ngaphakathi kwesiqondisi sephrofayela sithola izizindalwazi, amafayela weseshini, kanye nezinqolobane ezisivumela ukuthi sakhe kabusha umsebenzi wesiphequluli ngokunemba okukhulu.
Ekuhlaziyeni okuvamile, uchwepheshe uzobheka iseshini futhi ubuyisele amafayela i-Firefox eyisebenzisa ukuvula kabusha amathebhu ngemva kokuvalwa okungalindelekile. Ngisho noma umsebenzisi eke wazama «susa imikhondo» Ngisho nangemva kokuvala amafasitela noma ukususa umlando, imikhondo ingahlala kulawa mafayela, ku-cache, noma esikhaleni sediski esingakafakwanga esingakaze sibhalwe phansi.
Okunye okubalulekile yizizindalwazi ze-SQLite lapho iFirefox igcina khona idatha yayo. umlando, amabhukumaka, namafomuNgisho noma ulwazi lususwa ku-interface yesiphequluli uqobo, imikhondo etholakala kabusha ingase ihlale. Izibonelo zifaka phakathi okufakiwe okungenazintandane, imethadatha yokuvumelanisa, noma izingcezu zamalogi amadala angahlanzwanga ngokuphephile.
Elinye iphuzu elibalulekile yileli amakhukhi, imininingwane egciniwe kanye nedatha yeseshini yesevisi yewebhuLawa madivayisi avumela ama-akhawunti athile aku-inthanethi ukuthi axhunywe emshinini kanye nephrofayili ephenywayo. Esinqumweni sobugebengu noma sokuqondiswa kwezigwegwe, lokhu kungaba yinto ebalulekile ekuchazeni izenzo kumsebenzisi othile.
Ekugcineni, i Izengezo kanye nezandiso zifakiwe ku-Firefox Futhi bashiya umkhondo. Abanye izandiso ezinonya Iziphequluli ezinedumela elingabazisayo kungenzeka ukuthi zithathe idatha, zaqondisa kabusha ithrafikhi, noma zasusa ubufakazi. Ukubukeza uhlu lwesiphequluli sakho, izilungiselelo, namafayela ahlobene kusiza ekunqumeni ukuthi ngabe sisetshenziswe ngokusemthethweni noma njenge-vector yokuhlasela.
Izigaba zophenyo lwe-forensic olugxile ku-Firefox
Ngokombono wobungcweti, ukusebenza nge-Firefox sessions kanye namaphrofayili kuhlanganiswe ku- inqubo yokuhlolwa kwezomthetho ehlelwe ngezigaba ezininganaAkwanele nje ukuvula ifolda yephrofayela yakho bese uqala ukubuka amafayela angahleliwe. Udinga ukulandela indlela ecacile.
- Ukutholwa kanye nokuhlanganiswa kwemidiya efaneleAmadiski, ama-SSD, amadrayivu e-USB, kanye neminye imiqulu lapho kungase kube khona amaphrofayili abasebenzisi noma amakhophi esiphequluli aphathekayo. Amadivayisi okuhlanganisa ihadiwe anamabhulokhi okubhala avame ukusetshenziswa, okuqinisekisa ukuthi okwangempela kuhlala kungashintshiwe nhlobo.
- Ukuhlaziywa kwesakhiwo sohlelo lwefayelaYilapho amathuluzi akhethekile asebenza khona, akuvumela ukuthi uzulazule ezihlukanisweni, uthole amafayela asusiwe, futhi uthole iziqondisi zephrofayela yeFirefox noma ngabe umsebenzisi usezithuthile, waziqamba kabusha, noma wazama ukuzifihla.
- Ukulahla imemori ye-RAMEzimweni eziningi, amaseshini e-Firefox aqhubekayo, okhiye bokuqaqa amavolumu avikelwe, amathokheni okuqinisekisa, kanye nezinsalela zefomu kugcinwa kuphela kwimemori eguquguqukayo. Uma ikhompyutha ivaliwe ngaphandle kokuthatha le datha, bonke lobo bufakazi buyalahleka.
- Ukuhambisana kanye nokwakhiwa kabusha komugqa wesikhathi: Hlobanisa amalogi okuphequlula nemicimbi yesistimu, ukuxhumana kwenethiwekhi, izinguquko kurejista ye-Windows, umsebenzi wezinye izinhlelo, njll. Lo mbono wokulandelana kwezikhathi ukuvumela ukuthi ubone ukuthi umsebenzisi wenzeni ngempela, ngokulandelana ngakuphi, nokuthi uvela kusiphi isimo.
- Ukubhala umbiko wochwephesheIdokhumenti lapho uchwepheshe ethula khona amaqiniso afakazelwe, indlela esetshenzisiwe, kanye neziphetho zobuchwepheshe. Lo mbiko usebenza njengesisekelo sabameli, abahluleli, kanye nezikhulu zokuphepha ukwenza izinqumo. Ungahambisana nobufakazi bochwepheshe enkantolo.
Ukusatshalaliswa kwe-forensic kanye nezinhlelo zokusebenza zamaqembu okuphepha kwe-IT
Ukuze benze lolu hlobo lokuhlaziya ngendlela ethembekile, amaqembu amaningi ezokuphepha asebenzisa Ukusatshalaliswa kwe-Linux okwenzelwe ukuhlolwa kwe-computerLezi izinhlelo zokusebenza eziphelele ezihlanganisa iningi lamathuluzi adingekayo ukusebenza namakhophi ediski, izithombe zememori, namafayela esiphequluli.
Omunye wamasosha asebekhulile kulo mkhakha u- I-CAINE (Indawo Yokuphenya Esekelwa Yikhompyutha)Lolu uhlelo olusekelwe ku-Linux olune-interface yesithombe eyenzelwe ukuvumela uchwepheshe ukuthi aqalise imodi ebukhoma ngaphandle kokufinyelela i-hard drive yekhompyutha ephenywayo. Ukusuka lapho, bangakopisha, bahlaziye izingxenye, futhi basebenze ngamathuluzi anjenge-Autopsy, i-Sleuth Kit, i-RegRipper, i-Wireshark, i-PhotoRec, namanye amaningi.
I-CAINE nayo inezici ezihlukile: Ihlanganisa isethi yezinsiza eziphathwayo ze-Windows ngaphakathi kwesithombe sayo se-ISO. Ngokukhipha okuqukethwe kwayo, kungenzeka ukusebenzisa amathuluzi afana ne-FTK Imager, abahleli be-hex, ukuhlaziywa kwesistimu yamafayela e-NTFS, noma amathuluzi e-hashing ngqo ezinhlelweni ze-Windows. Asikho isidingo sokuqalisa i-Linux.
Elinye igama elibalulekile lithi I-Kali LinuxI-Kali, eyaziwa kakhulu emhlabeni wokuhlola ukungena kodwa futhi iwusizo kakhulu ku-digital forensics, ifaka inani elikhulu lezinsiza zokuhlaziya amadiski, inkumbulo, amanethiwekhi, kanye nezinto zobuciko zohlelo lokusebenza. Ngaphezu kwalokho, inikeza imodi ebukhoma ezinikele ye-forensics evimbela noma yikuphi ukubhala kumadiski ahlaziyiwe futhi iphoqe ukufakwa ngesandla kwamadivayisi angaphandle.
Amathuluzi ayisihluthulelo okuhlaziya i-forensic kwezikhathi namaphrofayili e-Firefox
Ngaphandle kokusabalalisa, amaqembu okuphepha kwe-IT athembele ku- iqoqo lamathuluzi athile amboza izendlalelo ezahlukene Ukuhlaziywa kufaka phakathi: idiski, i-RAM, inethiwekhi, isiphequluli, irejista ye-Windows, njll. Eziningi zazo zikhululekile futhi zivulekile, okwenza kube lula ukwamukelwa kwazo nokuhlolwa kwazo.
Enye yezinto ezaziwa kakhulu yi- I-AutopsyIsixhumi esibonakalayo se-Sleuth KitIkuvumela ukuthi uhlole izithombe zediski, uthole amafayela asusiwe, uhlaziye izinhlelo zamafayela, futhi uthole izinto zokuphequlula ezivela kuziphequluli ezahlukahlukene, kufaka phakathi iFirefox. Uhlobo lwayo olunwebekayo, olunama-plugins anweba ukusebenza kwayo, luyenze yaba yindinganiso yamaphoyisa, amabutho ahlomile, kanye namabhizinisi.
I-Sleuth Kit, yona, iyi- i-suite yokusetshenziswa komugqa womyalo ezinikeza ukufinyelela okuningiliziwe kumavolumu kanye nezinhlelo zamafayela. Ngendlela ye-modular, ivumela abahlaziyi ukuthi benze imisebenzi ngokuzenzakalelayo futhi bakhiphe ulwazi abaludingayo kuphela emininingwaneni eminingi. Isibonelo, ukulandelela iziqondisi zephrofayela ye-Firefox kuzo zonke izingxenye eziningi.
Ukwengeza kule ndlela, amathuluzi anjenge Uhlaka Lwe-Digital Forensics Banikeza isikhombikubona sezithombe kanye ne-API eyenzelwe ukwenza uphenyo lube ngokuzenzakalelayo. Ingasetshenziswa ukusebenza ngama-hard drive, inkumbulo eguquguqukayo, kanye nokukhiqiza imibiko ehlelekile, iqondisa umsebenzisi isinyathelo ngesinyathelo, okwenza kube usizo kokubili kochwepheshe kanye namalungu eqembu asafufusa.
Ukulahla nokuhlaziya i-RAM: amaseshini e-Firefox abukhoma
Uma kukhulunywa ngeFirefox, i-RAM ibalulekile ngoba yilapho amaseshini asebenzayo, iziqinisekiso zesikhashana, amathokheni okuqinisekisa, kanye nezinkinobho zokususa ukubethelaUma umhlaseli engene ngemvume ngaleso sikhathi, noma uma iFirefox isanda kuvala ngokuzumayo, i-RAM ingase ibe nedatha engeke ifinyelele kudiski.
Amathuluzi afana Ukuthwebula i-RAM ye-Magnet Zikuvumela ukuthi ubambe ngokuphephile okuqukethwe yimemori engokwenyama yekhompyutha, ukhiphe idatha eluhlaza ukuze ihlaziywe kamuva. Ngalolu hlobo lokulahla, kungenzeka ukuthola izinqubo zeFirefox, uhlole ukuthi yimaphi amamojula alayishiwe, ukubuyisa izinsalela zama-URL, amafomu, amakhukhi, nolunye ulwazi olubucayi.
Ukugxila kuphela ezinqubweni ezithile, njengesibonelo seFirefox ofuna ukusifunda, Ukuthwebula Inqubo ye-MAGNET Ivumela ukubamba inkumbulo yenqubo ngayinye. Le ndlela ikhiqiza umsindo omncane futhi ikhiqiza idatha engaphelele, okwenza kube lula ukukhipha ubufakazi obuwusizo ngaphandle kokuhlunga ama-gigabytes nama-gigabytes enkumbulo evamile.
Uma i-RAM isibanjiwe, izinhlaka ezifana I-volatility (okufakiwe ekusakazweni kwe-SIFT ye-SANS Institute) kuvumela ukuhlukaniswa kwalawa ma-dump. Ukuguquguquka kusekela amaphrofayili amaningi esistimu yokusebenza futhi kufaka phakathi ama-plugin ezinkampani zangaphandle okuhlaziya izinqubo, ukuxhumana, amamojula alayishiwe, kanye nokusesha amaphethini athile ahlobene neziphequluli kanye ne-malware.
Ukuhlaziywa kokuphequlula iwebhu kanye nezinto zobuciko zesiphequluli
Ukuze kugxilwe ekuzulazuleni kwangempela, kukhona amathuluzi anikezelwe kuwo Thwebula futhi ubuke umlando wesiphequluliNakuba eziningi zenzelwe i-Chrome, i-Edge noma i-Internet Explorer, zingasebenza namafayela akhiqizwe yi-Firefox.
Isibonelo yi-tandem Isithwebuli Somlando Wesiphequluli (i-BHC) kanye neSibukeli Somlando Wesiphequluli (i-BHV)I-BHC isebenza ezinhlelweni ze-Windows (ngisho naku-USB drive) futhi ikopisha amafayela omlando kusuka kuziphequluli ezinkulu kuya endaweni ethile, igcina ifomethi yawo yokuqala ukuze igweme ukonakalisa ubufakazi. I-BHV ibe isihumusha futhi ibonise lawa mafayela ngendlela ehlelekile ukuze abuyekezwe.
Ezimweni lapho kubalulekile ukumisa isimo sewebhusayithi njengoba iFirefox ibone ngesikhathi esithile, Isilondolozi Sekhasi Lewebhu le-MAGNET y I-FAW (Ukutholwa Kwamawebhusayithi Nge-Forensics) Zikuvumela ukuthi ulande amakhasi aphelele ukuze ahlaziywe ungaxhunyiwe ku-inthanethi. Lawa mathuluzi awusizo ekubhaleni okuqukethwe okungase kube okungekho emthethweni, amabhanela, amafomu, noma izikripthi ezingase zishintshe noma zinyamalale kamuva.
Uma umgomo uwukwakha kabusha uphenyo oluyinkimbinkimbi ngemithombo eminingi ehlukene (amadiski, i-RAM, ithrafikhi, umlando, amaselula), amapulatifomu afana I-SIFT (i-SANS Investigative Forensic Toolkit) Banikeza indawo yonke ngamathuluzi akamuva okuphendula ezigamekweni kanye nezikripthi. I-SIFT ivame ukubuyekezwa, ifaka i-Volatility, futhi ifaka isethi evumelanisiwe yezinsiza ze-DFIR ezongela abahlaziyi isikhathi esiningi.
Ubuqotho, ukurekhoda imisebenzi, kanye nezinye izinsiza zokusekela
Kunoma yiluphi uphenyo lwe-forensic, okuhlanganisa noluhilela i-Firefox, kubalulekile ukukwazi bonisa ubuqotho bobufakaziKu-Windows, izinhlelo ezifana I-CrowdResponse Zikuvumela ukuthi uqoqe ulwazi lwesistimu ngaphandle kokuphazamisa: izinqubo, izinsizakalo, ukucushwa kwenethiwekhi, amalogi emicimbi, nezinye izinkomba ezikusiza ukuthi uqonde umongo lapho iFirefox isetshenziswe khona. Konke lokhu kupakishwe ku-executable ephathekayo engadingi ukufakwa noma ukuncika kwangaphandle.
Kumafayela e-multimedia ahlobene nokuphequlula (izithombe namavidiyo alandiwe noma abukwe ku-Firefox), ithuluzi I-ExifTool Iwusizo kakhulu: Ingafunda, ibhale, futhi ihlele i-EXIF, i-GPS, i-IPTC, i-XMP, kanye neminye i-metadata eminingi. Le metadata ingaveza ukuthi ifayela ladalwa nini, likuphi indawo, ngayiphi idivayisi, kanye nesofthiwe elishintshiwe ngayo.
Ezinye izinsizakusebenza zokuhlola ubugebengu ezifana Ukubuka kokugcina Zikuvumela ukuthi wakhe kabusha umsebenzi womsebenzisi ku-Windows: izinhlelo ezivuliwe, amafayela afinyelelwe, izikhathi zokufaka noma zokukhipha, ukuvala nokuqalisa kabusha, njll. Lokhu kudala ilogi ewusizo yokuxhumanisa ukusebenza kwe-Firefox nezinye izenzo kukhompyutha. Futhi konke kusetshenziswa izinsiza ezincane kakhulu.
Ithrafikhi yenethiwekhi kanye nokwakhiwa kabusha kweseshini yewebhu
Ukuhlaziywa kwephrofayela yeFirefox kuthola amandla amakhulu uma kuhlanganiswa ne ukubanjwa kwethrafikhi yenethiwekhiAkusizi ngalutho ukubona ukuthi isiphequluli sivule i-URL uma singahlaziyi okwenzekile ezingeni lamaphakethe, amaphrothokholi kanye nokuqukethwe okushintshiwe.
Kulo mkhakha, I-Wireshark Iwumhlaziyi wephrothokholi ophelele. Imahhala, inomthombo ovulekile, futhi isebenzisa amapulatifomu ahlukahlukene, ikuvumela ukuthi uthwebule ithrafikhi ebukhoma noma ulayishe amafayela okuthwebula bese usebenzisa izihlungi ezinamandla ukuze ugxile kulokho okubalulekile: ithrafikhi ye-Firefox HTTP/HTTPS, ukuxhumana nezizinda ezithile, ukuxhawulana kwe-TLS, nokuningi.
Izipesheli ze-Wireshark ama-dissector ezinhlobonhlobo eziningi zezinqubo kanye nesixhumi esibonakalayo esicacile esihlela ulwazi ngezendlalelo ze-OSI. Lokhu kubuka kusiza ukuhlobanisa isicelo ngasinye sesiphequluli nezimpendulo zeseva, ukuqondisa kabusha okungenzeka, amakhodi amaphutha, ukufakwa kokuqukethwe, noma ukushintshaniswa kwesitifiketi sedijithali.
Amathuluzi afana I-NetworkMiner Zisekela i-Wireshark ngendlela yobuchwepheshe obuphezulu. Zikuvumela ukuthi ukhiphe amafayela, wakhe kabusha amaseshini, ukhombe izinhlelo zokusebenza, uvule amachweba, kanye nama-host ahilelekile ekuxhumaneni. Ngisho nenguqulo yamahhala inikeza ulwazi oluningi, futhi inguqulo yezentengiselwano inezela izici ezithuthukisiwe njenge-geolocation ye-IP kanye nokutholwa kwe-OS okunembile kakhudlwana.
Ezandleni zethimba lezokuphepha le-IT, inhlanganisela yamaphrofayili e-Firefox, ama-RAM dumps, kanye nokubamba inethiwekhi kuvumela yakha kabusha izikhathi zokuphequlula ezipheleleukuhlonza izenzo kumsebenzisi othile nokuthola ukuthi ngabe kube nokushintshwa kwethrafikhi, ukuhlaselwa kwe-Man-in-the-Middle, ukukhishwa kwedatha noma ukusetshenziswa kabi kwezitifiketi.
Ukuhlolwa kwekhompyutha kobungcweti kanye nezinsizakalo ezihambisanayo
Uma ucwaningo ngeFirefox luyingxenye yengxabano yezomthetho noma isigameko esingathi sÃna enkampanini, kuvamile ukusebenzisa izinsizakalo ezikhethekile ze-forensics zamakhompyuthaIzinkampani zamakhompyutha ezisebenza ngobuchwepheshe bezobunhloli zihlanganisa ochwepheshe ezindaweni ezahlukene (izinhlelo, amanethiwekhi, umthetho wezobuchwepheshe, ukuphepha kwe-inthanethi) abakwaziyo ukwenza uphenyo kusukela ekuqaleni kuze kube sekupheleni.
La maqembu awagcini nje ngokwenza ukuhlaziywa kobuchwepheshe, kodwa futhi anakekela iseluleko kusukela ngomzuzu wokuqala mayelana nendlela yokugcina ubufakazi, ukuthi yimiphi imishini okufanele ihlukaniswe, yiziphi izinyathelo okufanele zigwenywe ukuvimbela ukungcoliswa kobufakazi, kanye nendlela yokusebenzisana neminyango yezomthetho neyezisebenzi. Uma kudingeka, uchwepheshe uzofakaza enkantolo, echaza ngolimi olucacile lokho okutholakale kumaphrofayili nasezifundweni zeFirefox.
Ngaphezu kokuhlaziywa ngokwako, abahlinzeki abaningi banikeza izinsizakalo zokususa idatha ezivikelekile Ukuze kuvinjelwe ukuvuza kwedatha lapho imishini isetshenziswa kabusha noma ingasebenzi, ukususa amafayela noma ukwenza ifomethi esheshayo akwanele. Ngakho-ke, kusetshenziswa amathuluzi akwazi ukubhala kabusha imikhakha yamadiski izikhathi eziningi, elandela izindinganiso ezibekwe izinhlangano ezifana noMnyango Wezokuvikela wase-US.
Esinye isici esibalulekile yi- ukuphinda kusetshenziswe amapaki amakhompyuthaLokhu kuhlanganisa ukubhujiswa kwedatha okuphephile nokuphathwa kahle kwehadiwe kwemvelo. Ezinkampanini eziningi, lokhu kusho ukunikeza umhlinzeki oqinisekisa zombili lezi zici ukulahlwa kolwazi olubucayi kanye nokuphathwa kwemfucuza yezobuchwepheshe.
Okokugcina, ukuvimbela kuncike ku- amasevisi okusekelayo aphethwe kanye nokuvumelanisa idathaInqubomgomo yokusekela eqinile, eklanywe kahle futhi evivinywe kahle, ayigcini nje ngokunciphisa umthelela wesigameko, kodwa futhi inikeza imithombo eyengeziwe yobufakazi (amakhophi omlando wamaphrofayili e-Firefox, isibonelo) angaba usizo kakhulu ekuhlaziyweni kwe-forensic.
