Open Thunderbird with specific profile from another folder / Forensic Training / binsec.wiki | pentesting - secure coding - forensic

It is possible to start Thunderbird using a completely existing profile without configuring it any way manually. This is helpful when someone finds a Thunderbird profile during a forensic investigation and wants to have the same Thunderbird look and feel like the original user without navigating through files.

Thunderbird likes to have write access to this profile. So copying it from the read-only destination to a temp folder like /tmp/ is going to be helpful. In this example we open a profile iiae3qw2.default-release:

thunderbird -profile /tmp/iiae3qw2.default-release/

Last modified: April 21, 2023

binsec GmbH

binsec GmbH is a consulting firm for information security and was founded in 2013 by security experts. Our team consists of experienced, certified specialists with different areas of expertise. Due to our extensive expertise in many different IT security fields, we can support our customers with a wide array of issues. Most of our customers are medium-sized companies, for whom security is pivotal to success.

Keywords

Linux