Internet Explorer History File Format - Revision history

Joachim Metz: /* External Links */

2013-04-25T05:05:32Z

‎External Links

Joachim Metz: /* MSIE 5 - 9 */

2013-03-11T06:42:52Z

‎MSIE 5 - 9

Joachim Metz: /* Overview */

2013-03-11T06:42:37Z

‎Overview

Joachim Metz at 06:42, 11 March 2013

2013-03-11T06:42:10Z

Joachim Metz at 06:41, 11 March 2013

2013-03-11T06:41:23Z

Joachim Metz: /* File Header */

2013-03-11T06:23:36Z

‎File Header

Joachim Metz: /* Tools */

2013-03-10T16:16:40Z

‎Tools

Joachim Metz: /* File Header */

2013-03-10T16:15:08Z

‎File Header

Joachim Metz: /* External Links */

2013-03-10T15:07:07Z

‎External Links

Joachim Metz: /* External Links */

2013-03-10T15:05:00Z

‎External Links

@@ Line 146: / Line 146: @@
 * [http://www.forensicblog.org/2009/09/10/the-meaning-of-leak-records/ The Meaning of LEAK records], [[Mike Murr]], September 10, 2009
 * [http://blog.digital-detective.co.uk/2010/04/microsoft-internet-explorer-privacie.html Microsoft Internet Explorer PrivacIE Entries], by Digital Detective, April 29, 2010
 * [http://blogs.msdn.com/b/ieinternals/archive/2011/03/19/wininet-temporary-internet-files-cache-and-explorer-folder-view.aspx A Primer on Temporary Internet Files], by Eric Law, March 19, 2011

@@ Line 47: / Line 47: @@
 <pre>
 %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5
-<.pre>
+</pre>
 The folders will be named <tt>MSHist<two-digit number><starting four-digit year><starting two-digit month><starting two-digit day><ending four-digit year><ending two-digit month><ending two-digit day></tt>.  For example, the folder containing data from March 26, 2008 to March 27, 2008 might be named <tt>MSHist012008032620080327</tt>.

@@ Line 12: / Line 12: @@
 <b>Note that not every file named index.dat is a MSIE History (Cache) file.</b>
-The file format of MSIE 4 is slightly different then that of MSIE 5 up to 9. Most of the information on this page applies to the format used by MSEI 5 - 9.
+The file format of MSIE 4 is slightly different then that of MSIE 5 up to 9. Most of the information on this page applies to the format used by MSIE 5 - 9.
 MSIE 3 probably uses similar records in its History (Cache) files.

@@ Line 1: / Line 1: @@
 {{Expand}}
 [[Microsoft]] [[Internet Explorer]] (or MSIE) stores its web browsing history in files named <b>index.dat</b> as of version 4 up to version 9.
 By design these files are cache files but are used to:
 * keep a record of URLs that the browser has visited
 * cookies that were created by a site

@@ Line 1: / Line 1: @@
 {{Expand}}
-[[Internet Explorer]] as of version 4 up to version 9 stores the web browsing history in files named <tt>index.dat</tt>. The files contain multiple records.
+[[Microsoft]] [[Internet Explorer]] (or MSIE) stores its web browsing history in files named <b>index.dat</b> as of version 4 up to version 9.
-MSIE version 3 probably uses similar records in its History (Cache) files.
+By design these files are cache files but are used to:
 == File Locations ==
-Internet Explorer history files keep a record of URLs that the browser has visited, cookies that were created by these sites, and any temporary internet files that were downloaded by the site visit.  As a result, Internet Explorer history files are kept in several locations.  Regardless of the information stored in the file, the file is named index.dat.
+The index.dat files are stored in multiple locations.
 On Windows 95/98 these files were located in the following locations:
@@ Line 27: / Line 42: @@
 </pre>
-Internet Explorer also keeps daily, weekly, and monthly history logs that will be located in subfolders of %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5.  The folders will be named <tt>MSHist<two-digit number><starting four-digit year><starting two-digit month><starting two-digit day><ending four-digit year><ending two-digit month><ending two-digit day></tt>.  For example, the folder containing data from March 26, 2008 to March 27, 2008 might be named <tt>MSHist012008032620080327</tt>.
+Internet Explorer also keeps daily, weekly, and monthly history logs that will be located in a sub directory of the global history e.g. on Windows XP:
-Note that not every file named index.dat is a MSIE History (Cache) file.
+The folders will be named <tt>MSHist<two-digit number><starting four-digit year><starting two-digit month><starting two-digit day><ending four-digit year><ending two-digit month><ending two-digit day></tt>.  For example, the folder containing data from March 26, 2008 to March 27, 2008 might be named <tt>MSHist012008032620080327</tt>.
 == File Header ==
-Which represents the ASCII string "Client UrlCache MMF Ver 5.2"
+The MSIE 4 History (Cache) file starts with the following ACSII string: "Client UrlCache MMF Ver 4.7"
-The MSIE 4 index.dat files start with "Client UrlCache MMF Ver 4.7" and uses a different version of the format.
+The MSIE 5 - 9 History (Cache) file starts with the following ACSII string: "Client UrlCache MMF Ver 5.2"
-The next field in the file header starts at byte offset 28 and is a four byte representation of the file size.  The number will be stored in [[endianness | little-endian]] format so the numbers must actually be reversed to calculate the value.
+This string (or signature) is followed (at byte offset 28) by a four byte value containing the file size. The value is stored in [[endianness | little-endian]] so the individual bytes must read in reverse.
-Also of interest in the file header is the location of the cache directories.  In the URL records the cache directories are given as a number, with one representing the first cache directory, two representing the second and so on.  The names of the cache directories are kept at byte offset 64 in the file.  Each directory entry is 12 bytes long of which the first eight bytes contain the directory name.
+The file header also can contain the name of the cache directories. In the URL records the cache directories are given as a number, with one representing the first cache directory, two representing the second and so on.  The names of the cache directories are kept at byte offset 64 in the file.  Each directory entry is 12 bytes long of which the first eight bytes contain the directory name.
 == Allocation bitmap ==

@@ Line 33: / Line 33: @@
 == File Header ==
 Every version of Internet Explorer since Internet Explorer 5 has used the same structure for the file header and the individual records.  Internet Explorer history files begin with:
-6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32
+<pre>
-Which represents the ascii string "Client UrlCache MMF Ver 5.2"
+6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32
-The MSIE 4 index.dat files start with "Client UrlCache MMF Ver 4.7" and use a different version of the format.
+Which represents the ASCII string "Client UrlCache MMF Ver 5.2"
 The next field in the file header starts at byte offset 28 and is a four byte representation of the file size.  The number will be stored in [[endianness | little-endian]] format so the numbers must actually be reversed to calculate the value.

@@ Line 132: / Line 132: @@
 * [http://www.cqure.net/wp/iehist/ IEHist]
 * [[libmsiecf]]
-* [https://sourceforge.net/projects/odessa/ pacso], note this tool has not been updates since 2004 and is considered deprecated
+* [https://sourceforge.net/projects/odessa/ pacso], note this tool has not been updated since 2004 and is considered deprecated
 * [https://sourceforge.net/projects/pasco2/ pasco2]
 * [http://www.tzworks.net/prototype_page.php?proto_id=6 Windows 'index.dat' Parser (id)], by [[TZWorks LLC]]
 [[Category:File Formats]]

@@ Line 120: / Line 120: @@
 * [http://code.google.com/p/libmsiecf/downloads/detail?name=MSIE%20Cache%20File%20%28index.dat%29%20format.pdf MSIE Cache File (index.dat) format specification], by the [[libmsiecf|libmsiecf project]]
 * [http://kb.digital-detective.co.uk/display/NetAnalysis1/Internet+Explorer Digital Detective Knowledge Base: Internet Explorer]
 * [http://web.archive.org/web/20090824054415/http://www.foundstone.com/us/pdf/wp_index_dat.pdf Detailed analysis of index.dat file format], by Keith J. Jones, March 19, 2003
 * [http://www.forensicblog.org/2009/09/10/the-meaning-of-leak-records/ The Meaning of LEAK records], [[Mike Murr]], September 10, 2009