Koozali.org: home of the SME Server

How to recover/decipher files from squid cache

Offline joshAU

  • ***
  • 70
  • +0/-0
How to recover/decipher files from squid cache
« on: September 04, 2009, 05:10:31 AM »
Hello everyone, long time no post.

I'm trying to recover some files from the squid cache.

Is this doable?

I vaguely remember reading about this in these forums some months ago, but for the life of me I cant find the post.

I know the location of the cache files....

/var/spool/squid

and under thats a bunch of folders named 00, 01, 02 etc.

Within those 00, 01 etc folders there are more folders...similarly named.

Within these are files that contain a bit of info and then what looks like encrypted garbage..

EG

Code: [Select]
^Cg^@^@^@^C^P^@^@^@Ô¸©lÚp<æ½ýúÓ^T±^E^X^@^@^@C^DJC^DJÃUJMüpJ^@^@^@^@^A^@`^D$
HTTP/1.0 200 OK
Content-Type: image/gif
Content-Length: 20354
Server: DCLK Creative
Last-Modified: Thu, 30 Jul 2009 01:50:05 GMT
Cache-Control: max-age=86400
Date: Tue, 11 Aug 2009 05:40:19 GMT
Connection: keep-alive

GIF89al^B-^@æ^@^@Y·íg\ÈÕçâ(^G^@^A^FÝåñ¤¸Ëâbº±Åݦ˥»×<o¤ÕrÅÿÿÿâêô^@TÊËÍ$

^\lÜ'Þß^V'^Vã^V^Hæç^@é^@Aìì,ï#-,-ô^Tö^T;ù;^Züý%ÿ^@ÿ1^XH° Á^H^S*\Ȱ¡Ã^P#J81 Å$
êï ^T^D÷Ρ>^A^U
ZpU^X^]éX^A*¼,f(«^B^L` ¡×Í(2³û^Y° °1Ü ­3HcKø¢^@^@hàHH¬ðêÈ$üª!´ÊZÆÊe^XB^Y^[$
^OFÀ^FØP­jQÒò×<+í^FzÜêNð^G¨y^G|P
J^@^[5À^ZTm^D^H                 b
"Q^AÀ^@^F^O°Ò0^P@ ^E^U  )ª!A^NvÉË^\\^M^Và^KTÀ1bÔf^BÈ^\ÇW^T$B^T`ÿC4
Z^E%¯°J^EË;^AG^UÀª^^ ^@^F^U\Àײ·«¸p^AChÁ¼,°^@¦ÒH^Ar-§vN ´^^°Ó<-^P^[òN-âëO5aÃ$
~Î^C^D^B^G"%¼^\¸j^E^HP^Q¡S^E(9à^D^V¾´a^DÀá
~Ø[Ú^A^E°ÿL²^U^@^@P. ^@üd^C^VDUüT^O^_ðl^_÷m^A* É^B>àY°>^@^Dâ'^E^Pð©^FÐ
^FEL{°^_ø^T¹)PïuÀ§àï}×^[ÜöÈ76ïá^F^ZDÙË^RèÀ^_p^V`ù^B;ø^Z^B¨l  Á^Cº°h$  ^H$
`ü# h= å>pì4Û¼PAÐ^Pv^^ûüç@^OºÐNt¢ï\^H@@^C^TÐ.øÎ^W]^L^WàÒUÑ@ÒÕ
U^@Â^E^NÑ^Dx^@^B0ØÂ^V@Ù¡^K9ÕW¸X0è @`ÿ^W8á^LHÀ«T"^Z¯j^HøôFY^M:((=7Ù
X@!ì^@ÄÉ^Gi^M³!^VU ô^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^$
^Vw¸N¶ßãh­8+®^HWa'^Y^ò^U6¾Õ UWPÀ^K^V lÛ0^MÐ^BRµ^^^^^^^^^^^^^^^^^^^^^^$
y^X^^À^Ac±^O°^@ÕÔ,â^Ab@^N¦^@Ð^S=ÒërK:Q©Bn^Yy^X^Ep »j^X^^p^O9¹o
Ê ^Fø¬7"á^TJq)º^E^Ns,^@`]é^^n@^V÷ÿ^@«Hcf@^E§^B5 u%70)J^CW^@^@    ^@fÉ8Q$
©Ð^@DP^C·Ä^B^Zg^NP^CTPT^D^P^BY ^@^M¹KÅT5"^K^Z?©


Is it possible to decipher/recover info from these files.
Also, is there a file with a list of which cache files corresponds to an actual file?

Any help greatly appreciated.

joshAU

Offline Stefano

  • *
  • 10,894
  • +3/-0
Re: How to recover/decipher files from squid cache
« Reply #1 on: September 04, 2009, 08:21:37 AM »
hi

a quick  search on Google with 'squid recovering file from cache' keywords gives me many answers.. the first one should be interesting ;-)

Stefano