{"action":"created","issue":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/65","labels_url":"https://api.github.com/repos/log2timeline/plaso/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/65/comments","events_url":"https://api.github.com/repos/log2timeline/plaso/issues/65/events","html_url":"https://github.com/log2timeline/plaso/issues/65","id":51733765,"number":65,"title":"New Firefox cache structure","user":{"login":"pcbje","id":446726,"avatar_url":"https://avatars.githubusercontent.com/u/446726?v=3","gravatar_id":"","url":"https://api.github.com/users/pcbje","html_url":"https://github.com/pcbje","followers_url":"https://api.github.com/users/pcbje/followers","following_url":"https://api.github.com/users/pcbje/following{/other_user}","gists_url":"https://api.github.com/users/pcbje/gists{/gist_id}","starred_url":"https://api.github.com/users/pcbje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcbje/subscriptions","organizations_url":"https://api.github.com/users/pcbje/orgs","repos_url":"https://api.github.com/users/pcbje/repos","events_url":"https://api.github.com/users/pcbje/events{/privacy}","received_events_url":"https://api.github.com/users/pcbje/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/log2timeline/plaso/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"pcbje","id":446726,"avatar_url":"https://avatars.githubusercontent.com/u/446726?v=3","gravatar_id":"","url":"https://api.github.com/users/pcbje","html_url":"https://github.com/pcbje","followers_url":"https://api.github.com/users/pcbje/followers","following_url":"https://api.github.com/users/pcbje/following{/other_user}","gists_url":"https://api.github.com/users/pcbje/gists{/gist_id}","starred_url":"https://api.github.com/users/pcbje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcbje/subscriptions","organizations_url":"https://api.github.com/users/pcbje/orgs","repos_url":"https://api.github.com/users/pcbje/repos","events_url":"https://api.github.com/users/pcbje/events{/privacy}","received_events_url":"https://api.github.com/users/pcbje/received_events","type":"User","site_admin":false},"milestone":null,"comments":9,"created_at":"2014-12-11T20:26:45Z","updated_at":"2015-01-02T11:17:58Z","closed_at":null,"body":"Firefox changed its cache structure from version 32 (Released in September, 2014)*. The current Firefox cache parser is not compatible with these files. Some initial observations:\r\n\r\n* Cache files are located under ```~/Library/Caches/Firefox/Profiles/<profile_id>/cache2/entries/``` \r\n* Each file seems to contain the metadata and content for a single cache record (See sample)\r\n* Each cache file starts with content and ends with metadata (See sample)\r\n\r\n\\* https://twitter.com/JamesHabben/status/543123873555025920\r\n\\* http://www.janbambas.cz/new-firefox-http-cache-enabled/\r\n\r\n```\r\n$ ls ~/Library/Caches/Firefox/Profiles/di056l1c.default/cache2/entries | wc -l\r\n     638\r\n$ hexdump -C ~/Library/Caches/Firefox/Profiles/di056l1c.default/cache2/entries/3805705BAADF1CB3B00F863F9BE0EAD12132D1AA\r\n00000000  47 49 46 38 39 61 84 00  17 00 c4 15 00 fc f5 f5  |GIF89a..........|\r\n00000010  b5 02 02 e1 9a 9a fe fb  fb ed af af d1 38 38 e6  |.............88.|\r\n00000020  af af c0 38 38 d2 02 02  ed 9b 9b d1 04 04 ed 9a  |...88...........|\r\n00000030  9a d2 39 39 e7 b0 b0 c2  39 39 ed b0 b0 e2 99 99  |..99....99......|\r\n00000040  ff ff ff ef 99 99 b6 00  00 d6 00 00 ff ff ff 00  |................|\r\n00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\r\n00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 21 f9 04  |.............!..|\r\n00000070  01 00 00 15 00 2c 00 00  00 00 84 00 17 00 00 05  |.....,..........|\r\n00000080  ff 20 50 28 54 69 9e 68  aa ae 6c ab 2a 05 10 55  |. P(Ti.h..l.*..U|\r\n00000090  74 64 0f 44 22 ed 7c ef  ff c0 a0 f0 97 20 0c 0a  |td.D\".|...... ..|\r\n000000a0  ae a4 72 c9 a4 30 66 35  1b 61 48 ad 5a 85 0f 44  |..r..0f5.aH.Z..D|\r\n000000b0  73 cb 65 22 a0 15 5b 64  71 2d 9b 87 8b ae 7a bd  |s.e\"..[dq-....z.|\r\n000000c0  02 8b cf f0 38 8f 4d a7  bb 6d f2 bc b9 ce ef de  |....8.M..m......|\r\n000000d0  23 7a 81 55 7d 84 4c 7f  82 88 41 85 8b 2e 87 89  |#z.U}.L...A.....|\r\n000000e0  8f 73 2d 62 62 6c 36 84  8e 42 80 3d 9a 65 78 71  |.s-bbl6..B.=.exq|\r\n000000f0  8d 11 8c 7c 98 41 9e 3b  9c 57 a6 67 a0 2a 93 26  |...|.A.;.W.g.*.&|\r\n00000100  96 b0 a1 b1 af ae 25 b5  92 34 61 aa 40 6f a7 3c  |......%..4a.@o.<|\r\n00000110  93 9b 6f 93 9a c0 54 a0  b5 96 14 c9 c3 ca ae cb  |..o...T.........|\r\n00000120  a1 cd b6 d0 c9 2c a4 bc  12 9e c4 da a7 a8 d8 9c  |.....,..........|\r\n00000130  d9 dd 3f 13 e3 e4 e5 13  36 e6 e7 11 e3 e8 ea e5  |..?.....6.......|\r\n00000140  ed ec eb ee f3 c3 f2 e9  e4 7f 10 fa fb fc 10 11  |................|\r\n00000150  fa 36 fc 01 1c 36 30 e0  c0 7d f5 fa 29 bc f7 ce  |.6...60..}..)...|\r\n00000160  1e 3e 79 ed e0 cd 8b 47  91 9e 43 86 f8 72 89 51  |.>y....G..C..r.Q|\r\n00000170  d8 ef 5f c1 83 0a 27 81  f4 e7 91 e3 42 8c 13 1f  |.._...'.....B...|\r\n00000180  8e 56 94 c8 12 a2 cb 8a  e7 50 9e d3 68 d0 a4 40  |.V.......P..h..@|\r\n00000190  84 1e 6b 96 04 a9 b3 e4  4e 8e 32 25 3e 84 d7 b2  |..k.....N.2%>...|\r\n000001a0  e1 50 a2 62 64 ce 8c f2  33 64 47 9c 3d 6b 92 cc  |.P.bd...3dG.=k..|\r\n000001b0  b9 d1 a6 3e a5 58 b3 32  14 9a 35 9f d5 af 60 c3  |...>.X.2..5...`.|\r\n000001c0  5a d5 4a 16 eb a4 b2 19  99 8a 5d cb 16 2c da b7  |Z.J.......]..,..|\r\n000001d0  70 83 d2 6c da b6 2e db  b8 78 f3 b2 9b 6b b7 6f  |p..l.....x...k.o|\r\n000001e0  dd 00 7a 03 97 0d f0 47  80 df c3 60 05 1c 10 cc  |..z....G...`....|\r\n000001f0  18 ab 83 3f 06 10 4b 36  d9 00 c0 01 c0 8d 33 97  |...?..K6......3.|\r\n00000200  0b 70 40 c6 dc 01 06 0c  4f 9e 2c c0 c0 80 10 00  |.p@.....O.,.....|\r\n00000210  3b db d3 20 7a 94 62 00  00 00 01 00 00 00 04 54  |;.. z.b........T|\r\n00000220  89 f8 5d 54 89 f8 5d 3a  9a e3 7b 55 4b d4 6e 00  |..]T..]:..{UK.n.|\r\n00000230  00 00 34 3a 68 74 74 70  3a 2f 2f 67 66 78 2e 64  |..4:http://gfx.d|\r\n00000240  61 67 62 6c 61 64 65 74  2e 6e 6f 2f 74 65 67 6e  |agbladet.no/tegn|\r\n00000250  65 73 65 72 69 65 2f 66  6f 72 72 69 67 65 6e 65  |eserie/forrigene|\r\n00000260  73 74 65 2e 67 69 66 00  72 65 71 75 65 73 74 2d  |ste.gif.request-|\r\n00000270  6d 65 74 68 6f 64 00 47  45 54 00 72 65 73 70 6f  |method.GET.respo|\r\n00000280  6e 73 65 2d 68 65 61 64  00 48 54 54 50 2f 31 2e  |nse-head.HTTP/1.|\r\n00000290  31 20 32 30 30 20 4f 4b  0d 0a 53 65 72 76 65 72  |1 200 OK..Server|\r\n000002a0  3a 20 41 70 61 63 68 65  2f 32 2e 32 2e 32 34 0d  |: Apache/2.2.24.|\r\n000002b0  0a 4c 61 73 74 2d 4d 6f  64 69 66 69 65 64 3a 20  |.Last-Modified: |\r\n000002c0  54 68 75 2c 20 30 32 20  44 65 63 20 32 30 31 30  |Thu, 02 Dec 2010|\r\n000002d0  20 30 38 3a 35 38 3a 30  39 20 47 4d 54 0d 0a 45  | 08:58:09 GMT..E|\r\n000002e0  74 61 67 3a 20 22 32 63  62 38 35 61 65 2d 32 31  |tag: \"2cb85ae-21|\r\n000002f0  31 2d 34 39 36 36 39 39  65 66 34 61 65 32 61 22  |1-496699ef4ae2a\"|\r\n00000300  0d 0a 41 63 63 65 70 74  2d 52 61 6e 67 65 73 3a  |..Accept-Ranges:|\r\n00000310  20 62 79 74 65 73 0d 0a  58 2d 48 6f 73 74 2d 49  | bytes..X-Host-I|\r\n00000320  6e 64 65 78 3a 20 30 36  0d 0a 43 6f 6e 74 65 6e  |ndex: 06..Conten|\r\n00000330  74 2d 54 79 70 65 3a 20  69 6d 61 67 65 2f 67 69  |t-Type: image/gi|\r\n00000340  66 0d 0a 44 61 74 65 3a  20 54 68 75 2c 20 31 31  |f..Date: Thu, 11|\r\n00000350  20 44 65 63 20 32 30 31  34 20 32 30 3a 30 32 3a  | Dec 2014 20:02:|\r\n00000360  33 37 20 47 4d 54 0d 0a  41 67 65 3a 20 31 0d 0a  |37 GMT..Age: 1..|\r\n00000370  43 6f 6e 74 65 6e 74 2d  4c 65 6e 67 74 68 3a 20  |Content-Length: |\r\n00000380  35 32 39 0d 0a 00 00 00  02 11                    |529.......|\r\n```"},"comment":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/comments/68520307","html_url":"https://github.com/log2timeline/plaso/issues/65#issuecomment-68520307","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/65","id":68520307,"user":{"login":"pcbje","id":446726,"avatar_url":"https://avatars.githubusercontent.com/u/446726?v=3","gravatar_id":"","url":"https://api.github.com/users/pcbje","html_url":"https://github.com/pcbje","followers_url":"https://api.github.com/users/pcbje/followers","following_url":"https://api.github.com/users/pcbje/following{/other_user}","gists_url":"https://api.github.com/users/pcbje/gists{/gist_id}","starred_url":"https://api.github.com/users/pcbje/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcbje/subscriptions","organizations_url":"https://api.github.com/users/pcbje/orgs","repos_url":"https://api.github.com/users/pcbje/repos","events_url":"https://api.github.com/users/pcbje/events{/privacy}","received_events_url":"https://api.github.com/users/pcbje/received_events","type":"User","site_admin":false},"created_at":"2015-01-02T11:17:58Z","updated_at":"2015-01-02T11:17:58Z","body":"Any thoughts?"}}