Temporary Internet Files - Randomized folder names and/or structure

[maltmanic]

Hi,

I'm doing a final year computing project and I need to know what the
randomized folders are in the Internet Explorer's temporary internet
file directory.

For example (Vista):

Users\%USERACCOUNT%\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5

and

Users\%USERACCOUNT%\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Low\Content.IE5

'UQRYS05X'

'I81U2JRA'

etc...



Or in Windows XP:

Documents and Settings\%USERACCOUNT%\Local Settings\Temporary Internet
Files\Content.IE5

I know answers have been given for previous versions of IE (ver
3/4/5), yet they do not give the kind of detail I'm after...

What do these folders mean? Are they created in any specific way or is
it merely through an algorithm designed to give random identifiers?
Why are some files from the same sites kept in different folders even
when they appear to be only slightly different in name yet the same
format (ie icons/images)? Is there a size limit cut-off before a new
folder is created? Can these folder names be read in any way to
determine any sort of important information, such as date and time of
creation/network addresses etc?


Is this folder structure and naming convention something to do with
GUIDs and MAC addresses or is it more likely it's part of ASP
versions? I've been led to believe that the 'Low' directory is for
referencing use by Protected Mode, however the same folders appear in
Windows XP and folders in Vista which aren't part of 'Low'.



I've been looking on the net for the past 4 days for an answer to this
but there has been absolutely nothing which references the specific
details of these folders.


Please can someone help me with this?



Thanks!

 

[PA Bear [MS MVP]]

Do your own homework, please.

 

[Robert Aldwinckle]

Hi,

I'm doing a final year computing project and I need to know what the
randomized folders are in the Internet Explorer's temporary internet
file directory.

For example (Vista):

Users\%USERACCOUNT%\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5

and

Users\%USERACCOUNT%\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Low\Content.IE5

'UQRYS05X'

'I81U2JRA'

etc...



Or in Windows XP:

Documents and Settings\%USERACCOUNT%\Local Settings\Temporary Internet
Files\Content.IE5

I know answers have been given for previous versions of IE (ver
3/4/5), yet they do not give the kind of detail I'm after...

What do these folders mean? Are they created in any specific way or is
it merely through an algorithm designed to give random identifiers?
Why are some files from the same sites kept in different folders even
when they appear to be only slightly different in name yet the same
format (ie icons/images)? Is there a size limit cut-off before a new
folder is created? Can these folder names be read in any way to
determine any sort of important information, such as date and time of
creation/network addresses etc?


Is this folder structure and naming convention something to do with
GUIDs and MAC addresses or is it more likely it's part of ASP
versions? I've been led to believe that the 'Low' directory is for
referencing use by Protected Mode, however the same folders appear in
Windows XP and folders in Vista which aren't part of 'Low'.



I've been looking on the net for the past 4 days for an answer to this
but there has been absolutely nothing which references the specific
details of these folders.


Please can someone help me with this?

Usually such implementation details are proprietary.
So if you need to find out something about them you would have to do some
reverse engineering using black-box testing and analysis. Perhaps that is what
your project is intended to give you? <eg>

Hint: ProcMon would be a useful tool for doing this.


Good luck

Robert Aldwinckle
---

 

[maltmanic]

Thank you Robert for your advice. I will look into this angle.

PA Bear - The project is not on the temporary internet files. It is an
open question and I have chosen to do mine on windows exploitation and
data retrieval techniques. Hence why I am researching the temporary
internet files option and merely requesting background information to
the stated question, if known. As there has been no other information
on this particular subject which I have been able to find, I have
turned to the more educated experts who are part of the groups to
assist.