Internet Explorer History File Format
From Forensics Wiki
|
Please help to improve this article by expanding it.
|
Contents |
File Locations
On Windows 9x, index.dat files can be found in %SystemRoot%\History. On Windows XP and above these files can be found in %SystemDrive%\Documents and Settings\[Username]\Local Settings\History\History.IE6\.
Record Formats
URL Records
These records indicate web pages that were actually viewed. They contain the requested URL and the web server's response. They begin with the header, in hexadecimal:
55 52 4C 20
The definition for the structure in C99 format:
typedef struct _URL_RECORD {
/* 000 */ char Signature[4];
/* 004 */ uint32_t Length;
/* 008 */ uint64_t LastModified;
/* 010 */ uint64_t LastAccessed;
/* 018 */ uint32_t Expires;
/* 01c */
// Not finished yet
} URL_RECORD;
This corresponds to the string URL followed by a space.