Internet Explorer History File Format

From ForensicsWiki
Revision as of 17:26, 10 March 2007 by Jessek (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Internet Explorer stores the web browsing history in a file called index.dat. The file contains multiple records.

File Locations

On Windows 9x, index.dat files can be found in %SystemRoot%\History. On Windows XP and above these files can be found in %SystemDrive%\Documents and Settings\[Username]\Local Settings\History\History.IE6\.

Record Formats

URL Records

These records indicate web pages that were actually viewed. They contain the requested URL and the web server's response. They begin with the header, in hexadecimal:

55 52 4C 20

The definition for the structure in C99 format:

typedef struct _URL_RECORD {
  /* 000 */ char        Signature[4];
  /* 004 */ uint32_t    Length;
  /* 008 */ uint64_t    LastModified;
  /* 010 */ uint64_t    LastAccessed;
  /* 018 */ uint32_t    Expires;
  /* 01c */ 
  // Not finished yet
} URL_RECORD;

This corresponds to the string URL followed by a space.

REDR Records

HASH Records

LEAK Records

External Links