Opera Favicons
Overview
Section titled “Overview”Evidence: Opera Favicons
Description: Collect Opera Favicons
Category: Applications
Platform: linux
Short Name: ofico
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Browsers cache the icon of each page they render and record which page the icon belongs to. The favicon database is kept apart from browsing history, so its page URLs corroborate visits from a second source.
Data Collected
Section titled “Data Collected”This collector gathers structured data about opera favicons.
Opera Favicons Data
Section titled “Opera Favicons Data”| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
UserName | User Name | Example value |
BrowserName | Browser Name | Example value |
Profile | Profile | Example value |
URL | URL | Example value |
IconType | Icon Type | 123 |
Path | Path | Example value |
PageURL | Page the icon belongs to | https://example.com/page |
LastUpdated | Chromium icon time, in UTC. Empty for Firefox and Safari | 2023-10-15 14:30:25+03:00 |
ExpiresAt | Firefox mapping expiry, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
IconTimestamp | Safari icon time, in UTC. Empty for other browsers | 2023-10-15 14:30:25+03:00 |
Collection Method
Section titled “Collection Method”This collector copies the favicon database and its -wal, -shm, and -journal companions into the case, then parses each icon into the page URL it belongs to and the icon URL.
Forensic Value
Section titled “Forensic Value”Page and icon URL pairs show which pages the browser loaded, including full URLs with query strings, and can be correlated with history, downloads, and other browser artifacts. Clearing history in the browser also removes matching favicon data.