Talk:Internet Explorer History File Format

From ForensicsWiki
Revision as of 13:42, 20 June 2007 by Jessek (Talk | contribs) (Different Formats of index.dat)

Jump to: navigation, search

Planning on doing the following, any comments, ideas, objections?:

Move as DAT

I think this page should be moved as "DAT" and then let all Internet Explorer History File Format links redirect to the format DAT. Then in the DAT page, a little about how .dat is a common extention used by many programs to name their data files, and then the majority of the page about index.dat files specifically. --Kristofer 00:15, 19 June 2007 (PDT)

Because so many other programs use .dat as an extension, I don't think it's a good idea to make the .dat page all about Internet Explorer. Instead I think the .dat page should be a list of the programs that use .dat files, including Internet Explorer. I like having a page title that holds the true meaning, not a shorthand. Jessek 05:48, 20 June 2007 (PDT)

File Locations

After moving, more of the major file locations of the index.dat should be added too. I will type out the full paths later, but quickly for example, the temp internet files, cookies, history, userdat, folders. Also the ones in the system account in the windows directory, and note other accounts exist like the all users, administrator, network account, and i386 folder doesn't count does it? Also, correct me if I'm wrong, but the History.IE6 folder should be History.IE5, regardless of IE 5, 6, or 7 being installed. --Kristofer 00:15, 19 June 2007 (PDT)

This sounds like a great addition to the Internet Explorer History File Format page. Go for it! Jessek 05:49, 20 June 2007 (PDT)

Links is a great link in my opinion going through the methods of discovering the format of this unofficially documented file. It would be great, through the help of everyone, to fill in the missing parts of the general format and outline it here, for future programmers needing to do forensics with these files. --Kristofer 00:15, 19 June 2007 (PDT)

Different Formats of index.dat

We can write about the differences between the temporary internet files index.dat file, history index.dat file, and cookies index.dat file, while including the file paths of the other index.dat files but not emphasising on them, like the one in UserData folders.

Speaking about the three major ones seperately is important because some things are differen't between them, like the REDR tag is not in any history index.dat files, yet we have it listed on the current page. And in the URL tag, in the temporary internet files index.dat, the file name of the local cached file is specified with the originating URL. Another difference off the top of my head, the history index.dat files include page title names, and temporary internet files index.dat doesn't. --Kristofer 00:15, 19 June 2007 (PDT)

I think we should have a page of commonalities, but it should be separate from each of the format specific pages. That is, the Microsoft Windows Cookie Format page could have a short section on the common elements with a link to Common elements in Windows History Files. Maybe the "main" template would work well? Jessek 06:42, 20 June 2007 (PDT)