Can IE history be recovered? 1

[Zych]

Hello,

I have a client that needs to recovery her history. It seems like another employee removed it. Can this be done and how?

Thanks,

Zych

 

[eyec]

try a program called index.dat suite found at

http://support.it-mate.co.uk/?mode=Products&act=DL&p=index.datsuite

 

[tfg13]

Have you looked at this thread?

thread931-925100

 

[Zych]

Thanks for both replies. This may work. However playing on a system here at my house I noticed a problem. I went in and visted a couple of random web sites. I rebooted, then ran the index.dat suite. I found the sites I went to. I then went into Internet Tools and cleared the history. I then tried index.dat suite again and it showed some of the URL's but none of the ones I visited today. According to one article it should not delete these files when the history is cleared. I am not sure what is going on but I think I may try this anyways. Can anybody shed any light on why they are getting removed?

Thanks,

Zych

 

[linney]

Is this setting coming into play?

IE/ Tools/ Internet Options/ Advanced/ Security.
"Empty Temporary Internet Files when Browser is closed"
Specifies whether to clear the Temporary Internet Files folder when you close the browser.

 

[MysteryFCM]

Zych,
If you view the history via the history window in Index.dat Suite, and have cleared the history already, you will only be able to see it if you view the index.dat file itself (the history window pulls the information from Windows, but viewing the index.dat file displays the information regardless of whether the history has been cleared as this can only be cleared by deleting the index.dat file itself).

The particular file you need to view is the index.dat file located in the TIF folder.

Regards

Steven Burn
Ur I.T. Mate Group

http://www.it-mate.co.uk

 

[Zych]

When I told Index.dat Suite to find all Index.dat files it finds some in a History directory. Those are the ones I was looking in. I did not see any in a TIF directory. Where exactly is the TIF directory?

Thanks for your help,

Zych

 

[MysteryFCM]

TIF = Temporary Internet Files

It's actually stored in a hidden sub-folder called "Content.IE5", and will show in IDS with that in it's path.

Regards

Steven Burn
Ur I.T. Mate Group

http://www.it-mate.co.uk

 

[Zych]

I have looked under there also. It is not accurate either. Once I removed temporary Internet files this file shrunk by a lot.

I have tried the following directories under the user profile I am using:

localsettings\History\History.IE5\index.dat
localsettings\History\History.IE5\Histo~1\index.dat
localsettings\tempor~1\Content.IE5\index.dat

If I do not delete temporary Internet files or remove history they show everything. However it is my understaning that this does not affect the index.dat files, but in my instacne when they are deleted or removed my index.dat files seem to have been cleaned. There is some very old info still in there but the current places I visited are gone.

I take it that the article I read about this is wrong and that they are cleaned when temporary Internet files are removed and the History is wiped?

- Zych

 

[MysteryFCM]

Unless Microsoft has recently released a patch to change it's behaviour, this is certainly not the case.

Can you post the results of a scan (inc the file sizes)

Regards

Steven Burn
Ur I.T. Mate Group

http://www.it-mate.co.uk

 

[markdmac]

I'd use IESPY to generate a report. thread931-925100

I hope you find this post helpful.

Regards,

Mark

 

[tfg13]

Exactly what I was thinking Mark....

 

[markdmac]

I wish I could take credit for that script. I think Vengy did an awesome job in it.

I hope you find this post helpful.

Regards,

Mark

 

[tfg13]

I totally agree!!!

 

[Zych]

That's interesting. It works better but still does not show the complete list. I opened up Index.dat Suite and compared it to IESpy.HTM and see some in IESpy.HTM that are not in Index.dat Suite. However I visted two sites the other day that are not listed in either. I did clean the history out. I think I will try this at the clients place. Maybe I have some strange program running on this machine that I don't know about. It does look like IESpy is the better of the two (and easier to run).

I will let you know how it goes.

- Zych