Macromedia Flash Player settings.sol
Posted 23 November 2009 - 06:53 AM
As we know, Adobe Flash Player(AFP) is a well used method for streaming video to users.
Mtv, News, etc etc all use it.
CCleaner addresses the AFP application artifacts created in;
<drive>:\Documents and Settings\<userprofile>\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys and
<drive>:\Documents and Settings\<userprofile>\Application Data\Macromedia\Flash Player\#SharedObjects
But what I found recently is that AFP appends web site url hosts(domains) that were visited, ether typed/clicked or via popups, to the settings.sol file in <drive>:\Documents and Settings\<userprofile>\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys.
This file is not deleted by CCleaner. The decision may be intentional because this file may hold user defined setting from the Setting Manager(http://www.macromedi..._manager05.html).
But forensically or on the premise that this applicatoin cleans trace information, these url hosts should be removed.
If you would like to verify this artifact, just open your Adobe Flash Settings Manager, http://www.macromedi..._manager05.html, now or after a CClean.
Go to the "Website Storage Settings" or "Website Privacy Settings" tab, last two tabs.
If you see anything listed here, then sorry... GotYa.
You can also just open <drive>:\Documents and Settings\<userprofile>\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol file with a text editor and get an idea of what is going on.
Myself, if you could add this file for deletion to the default CCleaner analyser I would be happy, the file is recreated by AFP with default settings so no worries.
Or open the file and remove the 'domains' section, save and then cleanup cluster slack for that file, but I would imagine this would be much more coding.
Posted 28 November 2009 - 08:29 PM
Posted 29 November 2009 - 08:41 AM
IIRC this particular file was removed from the Flash Player cleaning due to complaints of Flash settings being reset (I have it as a custom file to be deleted)
Thanks for the tip JDPower! Am doing the same now.
Not sure why this file would be removed from standard cleaning, baring the user Flash settings, for it is a source of great forensic information regarding what sites a user has visited.
I mainly wanted folks to be aware of this artifact for I, and I bet others, are under the impression that CCleaner cleaned internet browsing activity(privacy claim). I have to say I was shocked to find this information lurking.
Posted 30 November 2009 - 10:04 PM