IE History - Can I recover it

Sageman,

You cannot recover the history once its deleted but you can read the Index.dat
files which will tell you which sites this user has been on

Here's the free download:

http://www.codeproject.com/vbscript/Internet_Explorer_Spy.asp

The above tool is absolutely superb!!!

You will need to register for a free Code Project account

When run it will create a file in C\ drive called Spy.htm which will contain all
URL's

At the end of the scan you have the option to delete all Index.dat files,
seleted or none on next boot

The download has a network version of the tool too

Hope this helps,

--
Newbie Coder
(It's just a name)




"Sageman" <Sageman.DeleteThis@discussions.microsoft.com> wrote in message
news:42A4AA1D-C561-4D9F-913D-6A5161886AB0@microsoft.com...
> We have an employee who appears to be browsing inappropriate web sites in his
> lunch hour. The IE history (normally stored for 30 days) has been deleted.
> Is there any way of recovering what the list of sites he had looked at or is
> there another way to do this in future.
>
> Thanks in advance for any help or advice.
>

If the user deleted History, then it can be assumed that he also deleted
TIFs and Cookies. The related DAT files will also be wiped when deleting
these caches.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Newbie Coder" <newbiecoder.DeleteThis@spammeplease.com> wrote in message
news:ubJD2nP4HHA.484@TK2MSFTNGP06.phx.gbl...
> Sageman,
>
> You cannot recover the history once its deleted but you can read the
> Index.dat
> files which will tell you which sites this user has been on
>
> Here's the free download:
>
> http://www.codeproject.com/vbscript/Internet_Explorer_Spy.asp
>
> The above tool is absolutely superb!!!
>
> You will need to register for a free Code Project account
>
> When run it will create a file in C\ drive called Spy.htm which will
> contain all
> URL's
>
> At the end of the scan you have the option to delete all Index.dat files,
> seleted or none on next boot
>
> The download has a network version of the tool too
>
> Hope this helps,
>
> --
> Newbie Coder
> (It's just a name)
>
>
>
>
> "Sageman" <Sageman.DeleteThis@discussions.microsoft.com> wrote in message
> news:42A4AA1D-C561-4D9F-913D-6A5161886AB0@microsoft.com...
>> We have an employee who appears to be browsing inappropriate web sites in
>> his
>> lunch hour. The IE history (normally stored for 30 days) has been
>> deleted.
>> Is there any way of recovering what the list of sites he had looked at or
>> is
>> there another way to do this in future.
>>
>> Thanks in advance for any help or advice.
>>
>
>

Gary,

The Index.dat files will still hold the information after the History, cookies,
cache has been deleted - believe me

Download the IE Spy I linked to & try it for yourself

--
Newbie Coder
(It's just a name)





"Gary S. Terhune" <none> wrote in message
news:uc0be1P4HHA.4676@TK2MSFTNGP05.phx.gbl...
> If the user deleted History, then it can be assumed that he also deleted
> TIFs and Cookies. The related DAT files will also be wiped when deleting
> these caches.
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
> "Newbie Coder" <newbiecoder DeleteThis @spammeplease.com> wrote in message
> news:ubJD2nP4HHA.484@TK2MSFTNGP06.phx.gbl...
> > Sageman,
> >
> > You cannot recover the history once its deleted but you can read the
> > Index.dat
> > files which will tell you which sites this user has been on
> >
> > Here's the free download:
> >
> > http://www.codeproject.com/vbscript/Internet_Explorer_Spy.asp
> >
> > The above tool is absolutely superb!!!
> >
> > You will need to register for a free Code Project account
> >
> > When run it will create a file in C\ drive called Spy.htm which will
> > contain all
> > URL's
> >
> > At the end of the scan you have the option to delete all Index.dat files,
> > seleted or none on next boot
> >
> > The download has a network version of the tool too
> >
> > Hope this helps,
> >
> > --
> > Newbie Coder
> > (It's just a name)
> >
> >
> >
> >
> > "Sageman" <Sageman DeleteThis @discussions.microsoft.com> wrote in message
> > news:42A4AA1D-C561-4D9F-913D-6A5161886AB0@microsoft.com...
> >> We have an employee who appears to be browsing inappropriate web sites in
> >> his
> >> lunch hour. The IE history (normally stored for 30 days) has been
> >> deleted.
> >> Is there any way of recovering what the list of sites he had looked at or
> >> is
> >> there another way to do this in future.
> >>
> >> Thanks in advance for any help or advice.
> >>
> >
> >
>
>

Not interested in signing up for weekly SPAM. Besides, I'm not on a machine
where I can do such things at the moment. But I know for a fact that when
you delete Cookies, the related entries in the DAT file also get deleted.
I'm 99.99% certain that it is that way with the TIF and History DAT files,
also. Or do you think that those files simply grow and grow and grow,
forever?

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Newbie Coder" <newbiecoder RemoveThis @spammeplease.com> wrote in message
news:eiTQ76P4HHA.5880@TK2MSFTNGP03.phx.gbl...
> Gary,
>
> The Index.dat files will still hold the information after the History,
> cookies,
> cache has been deleted - believe me
>
> Download the IE Spy I linked to & try it for yourself
>
> --
> Newbie Coder
> (It's just a name)
>
>
>
>
>
> "Gary S. Terhune" <none> wrote in message
> news:uc0be1P4HHA.4676@TK2MSFTNGP05.phx.gbl...
>> If the user deleted History, then it can be assumed that he also deleted
>> TIFs and Cookies. The related DAT files will also be wiped when deleting
>> these caches.
>>
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> www.grystmill.com
>>
>> "Newbie Coder" <newbiecoder RemoveThis @spammeplease.com> wrote in message
>> news:ubJD2nP4HHA.484@TK2MSFTNGP06.phx.gbl...
>> > Sageman,
>> >
>> > You cannot recover the history once its deleted but you can read the
>> > Index.dat
>> > files which will tell you which sites this user has been on
>> >
>> > Here's the free download:
>> >
>> > http://www.codeproject.com/vbscript/Internet_Explorer_Spy.asp
>> >
>> > The above tool is absolutely superb!!!
>> >
>> > You will need to register for a free Code Project account
>> >
>> > When run it will create a file in C\ drive called Spy.htm which will
>> > contain all
>> > URL's
>> >
>> > At the end of the scan you have the option to delete all Index.dat
>> > files,
>> > seleted or none on next boot
>> >
>> > The download has a network version of the tool too
>> >
>> > Hope this helps,
>> >
>> > --
>> > Newbie Coder
>> > (It's just a name)
>> >
>> >
>> >
>> >
>> > "Sageman" <Sageman RemoveThis @discussions.microsoft.com> wrote in message
>> > news:42A4AA1D-C561-4D9F-913D-6A5161886AB0@microsoft.com...
>> >> We have an employee who appears to be browsing inappropriate web sites
>> >> in
>> >> his
>> >> lunch hour. The IE history (normally stored for 30 days) has been
>> >> deleted.
>> >> Is there any way of recovering what the list of sites he had looked at
>> >> or
>> >> is
>> >> there another way to do this in future.
>> >>
>> >> Thanks in advance for any help or advice.
>> >>
>> >
>> >
>>
>>
>
>

Gary S. Terhune wrote:

> OK, just for the hell of it, I tried to download the thing. First, it
> insists that I log in. So, I signed up. Making me log in--first stupidity.
>
> Stupidity 2. The log in provides me with a password--hidden. No explanation
> or prompt to create my own. Had to do the Lost Password thing to get it
> mailed to me.
>
> Stupidity 3. Got all the above figured out and now I'm in an endless loop.
> Click to download, log in, click to download, log in. Tried all their
> suggestions with no luck.
>
> And these idiots pretend to be programmers?
>

For awhile, I thought I was going crazy. Both of us could not have been
experiencing the same thing unless it was really happening.

"Ghostrider" <-00-.TakeThisOut@fitron.142> wrote in message
news:uG6uftR4HHA.3916@TK2MSFTNGP02.phx.gbl...
>
> Gary S. Terhune wrote:
>
>> OK, just for the hell of it, I tried to download the thing. First, it
>> insists that I log in. So, I signed up. Making me log in--first
>> stupidity.
>>
>> Stupidity 2. The log in provides me with a password--hidden. No
>> explanation or prompt to create my own. Had to do the Lost Password thing
>> to get it mailed to me.
>>
>> Stupidity 3. Got all the above figured out and now I'm in an endless
>> loop. Click to download, log in, click to download, log in. Tried all
>> their suggestions with no luck.
>>
>> And these idiots pretend to be programmers?
>>
>
> For awhile, I thought I was going crazy. Both of us could not have been
> experiencing the same thing unless it was really happening.

For some reason I couldn't make myself play the login game. I saw the file
name in the link and Googled for it. Found it here:
http://lt.dorost.cz/public/scripts/?C=S;O=A

Comments in the script say:
....This program scans all History index files only (not cookies or temporary
internet files) looking for any protocol :// entries ....

A quick peek at the code indicates that something is stored in an array for
each entry found in the scan above. This entry is then used to search the
index.dat files which I assume then is used to get the info it puts out in
the HTML output file.

I won't be running this script until I verify it will do no harm on one of
my removable tray WXP systems.

-Paul Randall

Let us know-- IF you actually do the testing, <g>.

--
Gary S. Terhune
MS-MVP Shell/User
www.grystmill.com

"Paul Randall" <paulr901.DeleteThis@cableone.net> wrote in message
news:OoqRWFT4HHA.1484@TK2MSFTNGP06.phx.gbl...
>
> "Ghostrider" <-00-.DeleteThis@fitron.142> wrote in message
> news:uG6uftR4HHA.3916@TK2MSFTNGP02.phx.gbl...
>>
>> Gary S. Terhune wrote:
>>
>>> OK, just for the hell of it, I tried to download the thing. First, it
>>> insists that I log in. So, I signed up. Making me log in--first
>>> stupidity.
>>>
>>> Stupidity 2. The log in provides me with a password--hidden. No
>>> explanation or prompt to create my own. Had to do the Lost Password
>>> thing to get it mailed to me.
>>>
>>> Stupidity 3. Got all the above figured out and now I'm in an endless
>>> loop. Click to download, log in, click to download, log in. Tried all
>>> their suggestions with no luck.
>>>
>>> And these idiots pretend to be programmers?
>>>
>>
>> For awhile, I thought I was going crazy. Both of us could not have been
>> experiencing the same thing unless it was really happening.
>
> For some reason I couldn't make myself play the login game. I saw the
> file name in the link and Googled for it. Found it here:
> http://lt.dorost.cz/public/scripts/?C=S;O=A
>
> Comments in the script say:
> ...This program scans all History index files only (not cookies or
> temporary internet files) looking for any protocol :// entries ....
>
> A quick peek at the code indicates that something is stored in an array
> for each entry found in the scan above. This entry is then used to search
> the index.dat files which I assume then is used to get the info it puts
> out in the HTML output file.
>
> I won't be running this script until I verify it will do no harm on one of
> my removable tray WXP systems.
>
> -Paul Randall
>
>

The software runs fine on my WXP-SP2. It does create some potentially
dangerous .EXE files and runs them; created by writing a series of hex
values like "4D,5A,90,00,03,00,00,00,04,00,00,00,FF" to a file. My virus
scanner doesn't have a problem with it. The program gives you the option to
delete history stuff -- I hit cancel rather than try out that feature.

Apparently I haven't deleted my history for a while -- It found history
going back to October 2006.

It is an interesting script, commented well.

-Paul Randall

"Gary S. Terhune" <none> wrote in message
news:Obfn9JT4HHA.4880@TK2MSFTNGP03.phx.gbl...
> Let us know-- IF you actually do the testing, <g>.
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> www.grystmill.com
>
> "Paul Randall" <paulr901 DeleteThis @cableone.net> wrote in message
> news:OoqRWFT4HHA.1484@TK2MSFTNGP06.phx.gbl...
>>
>> "Ghostrider" <-00- DeleteThis @fitron.142> wrote in message
>> news:uG6uftR4HHA.3916@TK2MSFTNGP02.phx.gbl...
>>>
>>> Gary S. Terhune wrote:
>>>
>>>> OK, just for the hell of it, I tried to download the thing. First, it
>>>> insists that I log in. So, I signed up. Making me log in--first
>>>> stupidity.
>>>>
>>>> Stupidity 2. The log in provides me with a password--hidden. No
>>>> explanation or prompt to create my own. Had to do the Lost Password
>>>> thing to get it mailed to me.
>>>>
>>>> Stupidity 3. Got all the above figured out and now I'm in an endless
>>>> loop. Click to download, log in, click to download, log in. Tried all
>>>> their suggestions with no luck.
>>>>
>>>> And these idiots pretend to be programmers?
>>>>
>>>
>>> For awhile, I thought I was going crazy. Both of us could not have been
>>> experiencing the same thing unless it was really happening.
>>
>> For some reason I couldn't make myself play the login game. I saw the
>> file name in the link and Googled for it. Found it here:
>> http://lt.dorost.cz/public/scripts/?C=S;O=A
>>
>> Comments in the script say:
>> ...This program scans all History index files only (not cookies or
>> temporary internet files) looking for any protocol :// entries ....
>>
>> A quick peek at the code indicates that something is stored in an array
>> for each entry found in the scan above. This entry is then used to
>> search the index.dat files which I assume then is used to get the info it
>> puts out in the HTML output file.
>>
>> I won't be running this script until I verify it will do no harm on one
>> of my removable tray WXP systems.
>>
>> -Paul Randall
>>
>>
>
>

That sounds more complicated than it has to be. Here's a link to a freeware (and
safe) utility that enables one to read the contents of all index.dat files in
the system and delete any, as an option:

See inside index.dat files
http://www.stevengould.org/index.php?option=com_content&task=view&id=4...temid=8

"Paul Randall" <paulr901.DeleteThis@cableone.net> wrote in message
news:uSGD8qa4HHA.3716@TK2MSFTNGP03.phx.gbl...
> The software runs fine on my WXP-SP2. It does create some potentially
> dangerous .EXE files and runs them; created by writing a series of hex
> values like "4D,5A,90,00,03,00,00,00,04,00,00,00,FF" to a file. My virus
> scanner doesn't have a problem with it. The program gives you the option to
> delete history stuff -- I hit cancel rather than try out that feature.
>
> Apparently I haven't deleted my history for a while -- It found history
> going back to October 2006.
>
> It is an interesting script, commented well.
>
> -Paul Randall
>
> "Gary S. Terhune" <none> wrote in message
> news:Obfn9JT4HHA.4880@TK2MSFTNGP03.phx.gbl...
> > Let us know-- IF you actually do the testing, <g>.
> >
> > --
> > Gary S. Terhune
> > MS-MVP Shell/User
> > www.grystmill.com
> >
> > "Paul Randall" <paulr901.DeleteThis@cableone.net> wrote in message
> > news:OoqRWFT4HHA.1484@TK2MSFTNGP06.phx.gbl...
> >>
> >> "Ghostrider" <-00-.DeleteThis@fitron.142> wrote in message
> >> news:uG6uftR4HHA.3916@TK2MSFTNGP02.phx.gbl...
> >>>
> >>> Gary S. Terhune wrote:
> >>>
> >>>> OK, just for the hell of it, I tried to download the thing. First, it
> >>>> insists that I log in. So, I signed up. Making me log in--first
> >>>> stupidity.
> >>>>
> >>>> Stupidity 2. The log in provides me with a password--hidden. No
> >>>> explanation or prompt to create my own. Had to do the Lost Password
> >>>> thing to get it mailed to me.
> >>>>
> >>>> Stupidity 3. Got all the above figured out and now I'm in an endless
> >>>> loop. Click to download, log in, click to download, log in. Tried all
> >>>> their suggestions with no luck.
> >>>>
> >>>> And these idiots pretend to be programmers?
> >>>>
> >>>
> >>> For awhile, I thought I was going crazy. Both of us could not have been
> >>> experiencing the same thing unless it was really happening.
> >>
> >> For some reason I couldn't make myself play the login game. I saw the
> >> file name in the link and Googled for it. Found it here:
> >> http://lt.dorost.cz/public/scripts/?C=S;O=A
> >>
> >> Comments in the script say:
> >> ...This program scans all History index files only (not cookies or
> >> temporary internet files) looking for any protocol :// entries ....
> >>
> >> A quick peek at the code indicates that something is stored in an array
> >> for each entry found in the scan above. This entry is then used to
> >> search the index.dat files which I assume then is used to get the info it
> >> puts out in the HTML output file.
> >>
> >> I won't be running this script until I verify it will do no harm on one
> >> of my removable tray WXP systems.
> >>
> >> -Paul Randall
> >>
> >>
> >
> >
>
>

Hi,

In addition.....

Merge line 101: http://www.kellys-korner-xp.com/xp_tweaks.htm
--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm



"Sageman" <Sageman.TakeThisOut@discussions.microsoft.com> wrote in message
news:42A4AA1D-C561-4D9F-913D-6A5161886AB0@microsoft.com...
> We have an employee who appears to be browsing inappropriate web sites in
> his
> lunch hour. The IE history (normally stored for 30 days) has been
> deleted.
> Is there any way of recovering what the list of sites he had looked at or
> is
> there another way to do this in future.
>
> Thanks in advance for any help or advice.
>