Recover IE 7.0 websites visited?

[Ed Flecko]

I have an employee who's been surfing "questionable" sites, and
infected his PC with some nasty viruses. He uses IE 7.0, clears his
sites, cache, etc., and SWEARS he hasn't been hanging out at these
sites.

Is there any way of recovering a list of sites that a user has visited
in IE 7.0 (like there used to be with IE 6.0) after he's cleared his
cache, history, etc.?

Also, system restore is not turned on in his case, so I can't use
that.

Suggestions???

Thanks.

 

[Shenan Stanley]

I have an employee who's been surfing "questionable" sites, and
infected his PC with some nasty viruses. He uses IE 7.0, clears his
sites, cache, etc., and SWEARS he hasn't been hanging out at these
sites.

Is there any way of recovering a list of sites that a user has
visited in IE 7.0 (like there used to be with IE 6.0) after he's
cleared his cache, history, etc.?

Also, system restore is not turned on in his case, so I can't use
that.

Suggestions???

If you are not already tracking the internet activity (for everyone or that
machine) in some other way - and his cookies/TIF files are actually
emptied - then there is nothing retro-active (that I know of)you can do.

Also - System Restore restores system files - it would have no effect on the
user's files.

Does this user have rights beyong "user"? If so - why?

 

[Ed Flecko]

If you are not already tracking the internet activity (for everyone or that
machine) in some other way - and his cookies/TIF files are actually
emptied - then there is nothing retro-active (that I know of)you can do.

Also - System Restore restores system files - it would have no effect on the
user's files.

Does this user have rights beyong "user"? If so - why?

No, he has no elevated rights/privledges; he's just a normal domain
user. I'd just like to be able to PROVE that he's been hanging out at
websites that he SAYS he has not.

Arghhh.

 

[Shenan Stanley]

I have an employee who's been surfing "questionable" sites, and
infected his PC with some nasty viruses. He uses IE 7.0, clears his
sites, cache, etc., and SWEARS he hasn't been hanging out at these
sites.

Is there any way of recovering a list of sites that a user has
visited in IE 7.0 (like there used to be with IE 6.0) after he's
cleared his cache, history, etc.?

Also, system restore is not turned on in his case, so I can't use
that.

Suggestions???

If you are not already tracking the internet activity (for everyone
or that machine) in some other way - and his cookies/TIF files are
actually
emptied - then there is nothing retro-active (that I know of)you
can do.

Also - System Restore restores system files - it would have no
effect on the user's files.

Does this user have rights beyong "user"? If so - why?

No, he has no elevated rights/privledges; he's just a normal domain
user. I'd just like to be able to PROVE that he's been hanging out
at websites that he SAYS he has not.

Then how did he infest/infect the machine with anything? He wouldn't havew
the rights needed to mess up much more than his own profile...

Anyway - in order to track the Internet usage - you need a proxy server.
You could set up one and just point that one machine to it or do it for your
whole domain. Up to you.

You could also install software to track the usage... Usually this is
marketted for parents - but, same idea.

Retro-actively, if something is not already monitoring stuff, you have
pretty much nothing. Sorry. :-(

 

[MAP]

Even if a user clears their ie cache, sites visited will still be in the
index.dat files (forever or until deleted with a third party program such as
ccleaner),however opening this via notepad shows a mess of information with
the websites mixed in very hard to read,their are several free programs that
will display this file in a readable manner.

I have used this free viewer before when I first heard of it and it works
well.
http://www.softwarepatch.com/software/indexdat.html

or choose another.
http://www.google.com/search?hl=en&q=index.dat+viewers

 

[Daave]

I have an employee who's been surfing "questionable" sites, and
infected his PC with some nasty viruses. He uses IE 7.0, clears his
sites, cache, etc., and SWEARS he hasn't been hanging out at these
sites.

Other than "nasty viruses" (which can often be the result of e-mails
and/or a poorly patched system), what makes you think he has visited
"questionable sites?" Isn't it possible he's telling you the truth?
Which particular sites do you think he has visited?