Difference between pages "Internet Explorer History File Format" and "User:Cobalt2020"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(URL Records)
 
m
 
Line 1: Line 1:
{{Expand}}
+
== Cobalt's Userpage ==
[[Internet Explorer]] stores the web browsing history in a file called <tt>index.dat</tt>. The file contains multiple records.
+
  
== File Locations ==
+
I'm interested to see how forensicwiki will grow. My own forensic-related website/company is located at aeicomputertech.com [http://www.aeicomputertech.com].
 
+
On Windows 9x, index.dat files can be found in <tt>%SystemRoot%\History</tt>. On Windows XP and above these files can be found in <tt>%SystemDrive%\Documents and Settings\[Username]\Local Settings\History\History.IE6\</tt>.
+
 
+
== Record Formats ==
+
 
+
=== URL Records ===
+
 
+
These records indicate web pages that were actually viewed. They contain the requested URL and the web server's response. They begin with the header, in hexadecimal:
+
 
+
<pre>55 52 4C 20</pre>
+
 
+
The definition for the structure in C99 format:
+
 
+
<pre>typedef struct _URL_RECORD {
+
  /* 000 */ char        Signature[4];
+
  /* 004 */ uint32_t    Length;
+
  /* 008 */ uint64_t    LastModified;
+
  /* 010 */ uint64_t    LastAccessed;
+
  /* 018 */ uint32_t    Expires;
+
  /* 01c */
+
  // Not finished yet
+
} URL_RECORD;</pre>
+
 
+
This corresponds to the string <tt>URL</tt> followed by a space.
+
The actual interpretation of the "LastModified" and "LastAccessed" fields depends on the type of history file in which the record is contained. As a matter of fact, Internet Explorer uses three different types of history files, namely Daily History, Weekly History, and Main History. Other "index.dat" files are used to store cached copies of visited pages and cookies.
+
The information concerning how to intepret the dates of these different files can be found on Capt. Steve Bunting's web page at the University of Delaware Computer Forensics Lab (http://128.175.24.251/forensics/default.htm).
+
Please be aware that most free and/or open source index.dat parsing programs are not able to correctly interpret the above dates.
+
 
+
=== REDR Records ===
+
 
+
=== HASH Records ===
+
 
+
=== LEAK Records ===
+
 
+
== External Links ==
+
 
+
* [http://www.cqure.net/wp/?page_id=18 IEHist program for reading index.dat files]
+
* [http://www.milincorporated.com/a3_index.dat.html What is in Index.dat files]
+
 
+
[[Category:File Formats]]
+

Revision as of 10:03, 14 March 2007

Cobalt's Userpage

I'm interested to see how forensicwiki will grow. My own forensic-related website/company is located at aeicomputertech.com [1].