F-Response and Internet Evidence Finder (IEF)

After reading on Harlen Carvey's blog about (http://windowsir.blogspot.com) the excellent Internet Evidence Finder (IEF) from ADSoftware (http://www.jadsoftware.com/home/ief.htm), I thought that this sounded a great tool to use with live memory using F-Response.

Using VMware I started some Facebook chat using the chat applet and Yahoo messenger (although no one was online and no chat took place). I then started up F-Response and connected to the live running RAM and started IEF.








The tool worked as reported by others and was able to recover Facebook chat that the chat applet had loaded from the previous day that took place on another computer. The complete chat was recovered and I have blanked out the actual text from the below screenshot.