Firefox v13 will bring a slightly new look to some parts of the browser.  Both the New Tab and the Home Page have been redesigned.  The New Tab page now has links to your most recently and frequently visited sites which looks more or less just like Opera’s Speed Dial, which Chrome also mimics.  Some of this functionality has been added to Firefox v12 in anticipation of the release of Firefox v13.   Figure 1 shows Firefox v13 displaying the page thumbnails.  (warning) Please note, the implementation of the page thumbnails may change in future releases of Firefox.  As of Firefox v12, the data is stored in the cache against a special cache record as described below.


Figure 1

 

Whilst Firefox v12 does not show the new Speed Dial page when new tab is selected, the page thumbnails are still saved to the cache when a page is visited.  The URL portion of the cache entry looks like this:

 

Firefox moz-page-thumb cache entry
moz-page-thumb:http://www.browserforensics.com/2011-09-14-Test-Data/visit-count/multi-visit-test.htm

 

We have added additional support to HstEx v3.8 to recover these entries as part of the Firefox cache recovery.  NetAnalysis v1.54 also supports these cache entries, with the added bonus of being able to extract the page-thumb file (which is usually stored in PNG format).  Read more about Firefox Version 13.

These thumbnails can easily be exported and reviewed by the forensic investigator.  Using the 'Export/Rebuild Current Filtered Cache Items' feature from the main menu, the thumbnail entries can be exported from the cache.  To filter the records, search for "moz-page-thumb" across the imported Firefox v12 records and then select Tools » Export/Rebuild Current Filtered Cache Items.  The thumbnail files can then be examined from the "Extracted Files/PNG" folder.