IE History - Can I recover it

[Guest]

We have an employee who appears to be browsing inappropriate web sites in his
lunch hour. The IE history (normally stored for 30 days) has been deleted.
Is there any way of recovering what the list of sites he had looked at or is
there another way to do this in future.

Thanks in advance for any help or advice.

 

[Guest]

We have an employee who appears to be browsing inappropriate web sites in his
lunch hour. The IE history (normally stored for 30 days) has been deleted.
Is there any way of recovering what the list of sites he had looked at or is
there another way to do this in future.

Thanks in advance for any help or advice.

You can use this if you would like to nail the sun of gun, but if good at
his/her job and having a bad habit, then you need to tame of the shrew style?.
Implement a GPO policy you the admin and the rest are limited on what they
can do, for example cannot deleting their History or able to download
software on that account..etc.:
To create a new Group Policy object
http://www.microsoft.com/resources/...all/proddocs/en-us/createnewgpo.mspx?mfr=true
How To Use Group Policy to Deploy Windows XP in a Windows 2000-Based Network
http://support.microsoft.com/kb/314953
Lots of info here can be found:
http://search.microsoft.com/results...ng=en-US&q=how+to+create+a+group+policy+on+XP
Then you can read the Index.dat info and see the whole crap He/She been
viewing and let them face it and understand the danger they put first
themselves and the Co in, Financial and moral Effects!.
http://en.wikipedia.org/wiki/Index.dat
Index Dat Spy 2.0
http://www.stevengould.org/index.php?option=com_content&task=view&id=50&Itemid=89
HTH.
nass

 

[Peter Foldes]

Adding to the answer that nass has posted

You have posted this query before and you have gotten answers. The answer was NO you cannot recover the History links once they were deleted.

You can as nass has told you and try to stop the practice on what the employee is doing.

 

[Guest]

Thanks Nass - He stupidly did not remove the temporary internet files - not
pleasant reading - plenty of ammunition for the disciplinary hearing. Good
idea about the GPO - we are going to modify the policy so that noone can
delete their history - we'll see in time what that will bring.

Thanks for your help.

 

[Newbie Coder]

Sageman,

You cannot recover the history once its deleted but you can read the Index.dat
files which will tell you which sites this user has been on

Here's the free download:

http://www.codeproject.com/vbscript/Internet_Explorer_Spy.asp

The above tool is absolutely superb!!!

You will need to register for a free Code Project account

When run it will create a file in C\ drive called Spy.htm which will contain all
URL's

At the end of the scan you have the option to delete all Index.dat files,
seleted or none on next boot

The download has a network version of the tool too

Hope this helps,

 

[Gary S. Terhune]

If the user deleted History, then it can be assumed that he also deleted
TIFs and Cookies. The related DAT files will also be wiped when deleting
these caches.

 

[Newbie Coder]

Gary,

The Index.dat files will still hold the information after the History, cookies,
cache has been deleted - believe me

Download the IE Spy I linked to & try it for yourself

--
Newbie Coder
(It's just a name)

 

[Gary S. Terhune]

Not interested in signing up for weekly SPAM. Besides, I'm not on a machine
where I can do such things at the moment. But I know for a fact that when
you delete Cookies, the related entries in the DAT file also get deleted.
I'm 99.99% certain that it is that way with the TIF and History DAT files,
also. Or do you think that those files simply grow and grow and grow,
forever?

 

[Newbie Coder]

Gary,

The Code Project have never sent me a SPAM message/newsletter in the 3 or 4
years I have been a member. Its for coders who are sharing code...

I have written my own application that deletes the Index.dat files & I have seen
some users ox XP having 4 MB Index.dat files when mine are 32kb/48kb/64kb

Basically, I have given the OP a way to read this info, which is exactly what he
wants

 

[Gary S. Terhune]

OK, just for the hell of it, I tried to download the thing. First, it
insists that I log in. So, I signed up. Making me log in--first stupidity.

Stupidity 2. The log in provides me with a password--hidden. No explanation
or prompt to create my own. Had to do the Lost Password thing to get it
mailed to me.

Stupidity 3. Got all the above figured out and now I'm in an endless loop.
Click to download, log in, click to download, log in. Tried all their
suggestions with no luck.

And these idiots pretend to be programmers?

 

[Ghostrider]

OK, just for the hell of it, I tried to download the thing. First, it
insists that I log in. So, I signed up. Making me log in--first stupidity.

Stupidity 2. The log in provides me with a password--hidden. No explanation
or prompt to create my own. Had to do the Lost Password thing to get it
mailed to me.

Stupidity 3. Got all the above figured out and now I'm in an endless loop.
Click to download, log in, click to download, log in. Tried all their
suggestions with no luck.

And these idiots pretend to be programmers?

For awhile, I thought I was going crazy. Both of us could not have been
experiencing the same thing unless it was really happening.

 

[Peter Foldes]

Newbie Coder

I think you are wrong about the Index.dat files. They do not retain any info as you say. Mine is 32kb/40kb/46kb and I doubt that it has grown . This is a W2K3 Sever Production machine and I access the Net quite heavily and have for the last 4 yrs with this OS. If it was as you claim\say my index.dat files should be in the GB size by now.

 

[Newbie Coder]

Peter,

I delete my Index.dat files regularly on my Windows 2000 Pro development machine
& Windows 2003 Enterprise Server

--
Newbie Coder
(It's just a name)



Newbie Coder

I think you are wrong about the Index.dat files. They do not retain any info as
you say. Mine is 32kb/40kb/46kb and I doubt that it has grown . This is a W2K3
Sever Production machine and I access the Net quite heavily and have for the
last 4 yrs with this OS. If it was as you claim\say my index.dat files should be
in the GB size by now.

 

[Newbie Coder]

Gary,

I have neve had a problem

Yes, after you create the accout you're e-mailed but you can also change your
password to whatever you want

Never, ever have I had a problem with that site

Click the download link & it will take you to the login page. Login & it takes
you back to the download. Click it again & save to your computer

To change your password just click My Settings (top-right), type new password &
confirm then click the save button at the base of the page

Simple

 

[Paul Randall]

For awhile, I thought I was going crazy. Both of us could not have been
experiencing the same thing unless it was really happening.

For some reason I couldn't make myself play the login game. I saw the file
name in the link and Googled for it. Found it here:
http://lt.dorost.cz/public/scripts/?C=S;O=A

Comments in the script say:
....This program scans all History index files only (not cookies or temporary
internet files) looking for any protocol :// entries ....

A quick peek at the code indicates that something is stored in an array for
each entry found in the scan above. This entry is then used to search the
index.dat files which I assume then is used to get the info it puts out in
the HTML output file.

I won't be running this script until I verify it will do no harm on one of
my removable tray WXP systems.

-Paul Randall

 

[Gary S. Terhune]

Let us know-- IF you actually do the testing, <g>.

 

[Gary S. Terhune]

1. It's stupid to have an account setup that requires you to first go to
your email to find the password before you can continue using the site.

2. As I said, it put me into a permanent loop. Download page, login page,
download page, login page, ad infinitum.

Even if it worked, it's a crappy site, especially one supposedly maintained
by programmers. Really lousy. I'm certainly not going to run anything from
there, and I have to say that I don't have enough confidence in you to take
your word for it that it's a safe script to run.

 

[Gary S. Terhune]

Why? Because you *think* they retain some kind of permanent history?

 

[Newbie Coder]

Gary,

I see you are no programmer Gary otherwise you would find the site very useful.
That's why your MVP is Shell like most people's & not a programming language

It's your opinion only about the site, but I like millions of others like it.
You're in the minority here

 

[Paul Randall]

The software runs fine on my WXP-SP2. It does create some potentially
dangerous .EXE files and runs them; created by writing a series of hex
values like "4D,5A,90,00,03,00,00,00,04,00,00,00,FF" to a file. My virus
scanner doesn't have a problem with it. The program gives you the option to
delete history stuff -- I hit cancel rather than try out that feature.

Apparently I haven't deleted my history for a while -- It found history
going back to October 2006.

It is an interesting script, commented well.

-Paul Randall