dvw said:
I have a client who needs to review the internet history file on a particular
computer back to August 3, 2005. Unfortunately, the save history setting on
this workstation is set to 20 days. Is there any way to search history beyond
the 20 days, or is the history data truly deleted after the 20 days? The
workstation is running XP Pro, with IE 6.
TIA.
Open a cmd window and see what's really there:
cd /d %USERPROFILE%\Local Settings\History\History.IE5
dir/ad/o-d
E.g. you may find some older subdirectories that way
and in them you would find the index.dat file containing
the history for that implied period.
Tip: to list (most of) the URLs contained in a History index.dat
try navigating to the chosen subdirectory (Tip: right-click and drag
to select one and then build the necessary cd command
by copying that selection.) and then enter:
find /i "<the userid followed by an at sign>" index.dat
(I just noticed that in the lower level subdirectories the
data items have a different prefix. You could alternatively
use it. Apparently only the top level index.dat has the
very handy "Visited:" identifier prefixing its entries.
That's the one I usually use.)
To get more accurate date and timestamps associated
with each entry you would have to use a third-party
History browser or write your own program or script
to decode the binary data.
Good luck
Robert Aldwinckle
---
