Galleta – Forensic Analysis Tool For IE Cookies
Whenever you visit any webpage, a cookie is generated. This cookie file is saved on the visitor’s computer and are in a format which is not interpretable easily. Galleta is a free tool that has been developed to examine the contents of the Internet Explorer’s cookie files.
It is a command line tool that helps you examine the contents of the cookie files by converting the information in these files in to a format which you may export in to your favorite spreadsheet program for further analysis. Cookie files for the Internet Explorer of Windows XP are saved at the location C:\Documents and Settings\Username\Local Settings\Temporary Internet Files, and in Windows 7 I am able to locate the cookie files at the C:\Users\Username\AppData\Local\Microsoft\Windows\Temporary Internet Files path.
Install Galleta from the link mentioned at the end of this post and run the following command with necessary modifications in the command prompt:
galleta.exe “aun@google.txt” > “google”
Where aun is the name of my admin user, google.txt is the cookie file for Google and google is the final output file. The output file will be saved at the location where you run this command. Now you may easily open this output file with your favorite spreadsheet program.
It works on all versions of Windows, including the latest Windows 7. Enjoy!
