Monday, April 10, 2006

Cookie file format of Internet explorer

Cookies are at C:\Documents and Settings\[user name]\Cookies

Cookie name
Cookie value
Host/path for the web server setting the cookie
Flags
Exirpation time (low)
Expiration time (high)
Creation time (low)
Creation time (high)
Record delimiter (*)

Conversion of the time to the number of seconds
elapsed since midnight (00:00:00), January 1, 1970,

t = 1e-7*(high*pow(2,32)+low) - 11644473600



Reference:
Galleta - An Internet Explorer Cookie Analysis Tool

2 comments:

Jillian said...

Here are 2 references for future readers:

Cookie Dethroning.::DEMYSTIFIED::
pdf
(source)

Forensic Analysis of Microsoft Internet Explorer
Cookie Files

pdf
(source)

Dakkar said...

I need flags bit mask info... I've found just 3 meanings (bit 0,6,13) but I miss others (especially: 9 and 10)