History - but no temp files?

[asrisk]

Hi all. I am looking into potential misuse of a computer for which I have responsibility. There is evidence in the History that an inappropriate website was visited, the page titles suggesting a registration process was completed. There is a cookie for said site, created on the same date, and showing the referral from Google. The Google search is also in the History.

BUT - there are no Temporary Internet Files relating to the site. There are plenty of other Temporary Internet Files pre-dating and post-dating this event, it has not been emptied, but none relating to this site.

Might this be because:
1) The site did not generate any temp files (is this likely/plausible)?
2) The user deleted the (specific) temp files for that site, despite being not tech-savvy enough to clear the History?
3) Someone planted the history files and cookie there? Can the date-last-visited and number-of-visits be faked?

It's Windows XP home, single user system with IE only.

Thoughts appreciated,

Cheers,
Q

-------
The joke cannot be found
^{The funny quote you are looking for might have been removed, had its name changed, or is temporarily unavailable.}

 

[sleipnir214]

It's possible, I suppose, that the site could have transmitted to the browser a set of HTTP headers that would keep IE from cacheing the site.

Have you run Web Historian (link) on the machine?



Want the best answers? Ask the best questions! TANSTAAFL!

 

[eyec]

you could try using a program called indexdat suite. it will quite oftern reveal files some thought were erased.

you can find it @

http://support.it-mate.co.uk/?mode=Products&p=Index.datSuite

 

[tfg13]

Or, even use this:

faq779-6302

 

[asrisk]

Thank you all for the file links, I'll give some of them a try. Its interesting to learn that a website can exclude itself from being cached.

Q.

-------
The joke cannot be found
^{The funny quote you are looking for might have been removed, had its name changed, or is temporarily unavailable.}