Difference between pages "Incident Response Collection Report" and "Internet Explorer History File Format"
(→File Header: Linked little-endian to the article on endianness) |
|||
| Line 1: | Line 1: | ||
{{Expand}} | {{Expand}} | ||
| + | [[Internet Explorer]] stores the web browsing history in a file called <tt>index.dat</tt>. The file contains multiple records. | ||
| − | + | == File Locations == | |
| − | + | On Windows 9x, index.dat files can be found in <tt>%SystemRoot%\History</tt>. On Windows XP and above these files can be found in <tt>%SystemDrive%\Documents and Settings\[Username]\Local Settings\History\History.IE6\</tt>. | |
| − | == | + | == File Header == |
| + | Every version of Internet Explorer since Internet Explorer 5 has used the same structure for the file header and the individual records. Internet Explorer history files begin with: | ||
| + | 43 6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32 | ||
| + | Which represents the ascii string "Client UrlCache MMF Ver 5.2" | ||
| − | + | The next field in the file header starts at byte offset 28 and is a four byte representation of the file size. The number will be stored in [[endianness | little-endian]] format so the numbers must actually be reversed to calculate the value. | |
| + | |||
| + | Also of interest in the file header is the location of the cache directories. In the URL records the hash directories are given as a number, with one representing the first cache directory, two representing the second and so on. The hash directories are kept at byte offset 64 in the file. Each directory entry is 12 bytes long, but only the first eight bytes are relevant. | ||
| + | |||
| + | == Record Formats == | ||
| + | |||
| + | === URL Records === | ||
| + | |||
| + | These records indicate web pages that were actually viewed. They contain the requested URL and the web server's response. They begin with the header, in hexadecimal: | ||
| + | |||
| + | <pre>55 52 4C 20</pre> | ||
| + | |||
| + | The definition for the structure in C99 format: | ||
| + | |||
| + | <pre>typedef struct _URL_RECORD { | ||
| + | /* 000 */ char Signature[4]; | ||
| + | /* 004 */ uint32_t Length; | ||
| + | /* 008 */ uint64_t LastModified; | ||
| + | /* 010 */ uint64_t LastAccessed; | ||
| + | /* 018 */ uint32_t Expires; | ||
| + | /* 01c */ | ||
| + | // Not finished yet | ||
| + | } URL_RECORD;</pre> | ||
| + | |||
| + | This corresponds to the string <tt>URL</tt> followed by a space. | ||
| + | |||
| + | |||
| + | The actual interpretation of the "LastModified" and "LastAccessed" fields depends on the type of history file in which the record is contained. As a matter of fact, Internet Explorer uses three different types of history files, namely Daily History, Weekly History, and Main History. Other "index.dat" files are used to store cached copies of visited pages and cookies. | ||
| + | The information concerning how to intepret the dates of these different files can be found on Capt. Steve Bunting's web page at the University of Delaware Computer Forensics Lab (http://128.175.24.251/forensics/default.htm). | ||
| + | Please be aware that most free and/or open source index.dat parsing programs, as well as quite a few commercial forensic tools, are not able to correctly interpret the above dates. More specifically, they interpret all the time and dates as if the records were contained into a Daily History file regardless of the actual type of the file they are stored in. | ||
| + | |||
| + | === REDR Records === | ||
| + | |||
| + | === HASH Records === | ||
| + | |||
| + | === LEAK Records === | ||
== External Links == | == External Links == | ||
| − | * [http:// | + | |
| − | [[Category: | + | * [http://www.cqure.net/wp/?page_id=18 IEHist program for reading index.dat files] |
| + | * [http://www.milincorporated.com/a3_index.dat.html What is in Index.dat files] | ||
| + | |||
| + | [[Category:File Formats]] | ||
Revision as of 13:55, 19 March 2008
|
|
Please help to improve this article by expanding it.
|
Contents |
File Locations
On Windows 9x, index.dat files can be found in %SystemRoot%\History. On Windows XP and above these files can be found in %SystemDrive%\Documents and Settings\[Username]\Local Settings\History\History.IE6\.
File Header
Every version of Internet Explorer since Internet Explorer 5 has used the same structure for the file header and the individual records. Internet Explorer history files begin with:
43 6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32
Which represents the ascii string "Client UrlCache MMF Ver 5.2"
The next field in the file header starts at byte offset 28 and is a four byte representation of the file size. The number will be stored in little-endian format so the numbers must actually be reversed to calculate the value.
Also of interest in the file header is the location of the cache directories. In the URL records the hash directories are given as a number, with one representing the first cache directory, two representing the second and so on. The hash directories are kept at byte offset 64 in the file. Each directory entry is 12 bytes long, but only the first eight bytes are relevant.
Record Formats
URL Records
These records indicate web pages that were actually viewed. They contain the requested URL and the web server's response. They begin with the header, in hexadecimal:
55 52 4C 20
The definition for the structure in C99 format:
typedef struct _URL_RECORD {
/* 000 */ char Signature[4];
/* 004 */ uint32_t Length;
/* 008 */ uint64_t LastModified;
/* 010 */ uint64_t LastAccessed;
/* 018 */ uint32_t Expires;
/* 01c */
// Not finished yet
} URL_RECORD;
This corresponds to the string URL followed by a space.
The actual interpretation of the "LastModified" and "LastAccessed" fields depends on the type of history file in which the record is contained. As a matter of fact, Internet Explorer uses three different types of history files, namely Daily History, Weekly History, and Main History. Other "index.dat" files are used to store cached copies of visited pages and cookies.
The information concerning how to intepret the dates of these different files can be found on Capt. Steve Bunting's web page at the University of Delaware Computer Forensics Lab (http://128.175.24.251/forensics/default.htm).
Please be aware that most free and/or open source index.dat parsing programs, as well as quite a few commercial forensic tools, are not able to correctly interpret the above dates. More specifically, they interpret all the time and dates as if the records were contained into a Daily History file regardless of the actual type of the file they are stored in.
