Difference between pages "TDMA" and "Internet Explorer History File Format"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
{{Wikify}}
+
{{Expand}}
 +
[[Internet Explorer]] as of version 4 stores the web browsing history in files called <tt>index.dat</tt>. The files contain multiple records.
 +
MSIE version 3 probably uses similar records in its History (Cache) files.
  
'''TDMA - Time Division Multiple Access'''
+
== File Locations ==
  
 +
Internet Explorer history files keep a record of URLs that the browser has visited, cookies that were created by these sites, and any temporary internet files that were downloaded by the site visit.  As a result, Internet Explorer history files are kept in several locations.  Regardless of the information stored in the file, the file is named index.dat.
  
== Why use TDMA?==
+
On Windows 95/98 these files were located in the following locations:
TDMA (Time Division Multiple Access), has the largest network in the US. It is a digital wireless communication method allowing many users to access a single radio frequency without interference.  Every individual user is given a unique time slot within each channel.  It increases the efficiency of transmission and offers a number of other advantages.  A major pro is it can be easily adapted to transmission of data as well as voice communication.  It offers the ability to carry date rates of 64 kbps to 120 mbps, which enables options of communication such as fax, voiceband data, sms, as well as bandwidth intensive apps.  TDMA allows the user to have extended battery life since the mobile is only transmitting a portion of the time during conversations.  Furthermore, it is the most cost effective technology for upgrading a current analog system to digital.
+
<tt>%systemdir%\Temporary Internet Files\Content.ie5
 +
%systemdir%\Cookies
 +
%systemdir%\History\History.ie5</tt>
  
==How it works==
+
On Windows 2000/XP the file locations have changed:
 +
<tt>%systemdir%\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.ie5
 +
%systemdir%\Documents and Settings\%username%\Cookies
 +
%systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5</tt>
  
It’s necessary for TDMA to rely upon that fact that the audio signal has been digitized.  These signals are divided into a number of milliseconds.  TDMA is also the access technique used in the European digital standard, GSM, and the Japanese digital standard, personal digital cellular (PDC). The reason for choosing TDMA for all these standards was that it enables some vital features for system operation in an advanced cellular or PCS environment. Today, TDMA is an available, well-proven technique in commercial operation in many systems.
+
Internet Explorer also keeps daily, weekly, and monthly history logs that will be located in subfolders of %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5.  The folders will be named <tt>MSHist<two-digit number><starting four-digit year><starting two-digit month><starting two-digit day><ending four-digit year><ending two-digit month><ending two-digit day></tt>. For example, the folder containing data from March 26, 2008 to March 27, 2008 might be named <tt>MSHist012008032620080327</tt>.
A single channel can carry all four conversations if each conversation is divided into relatively short fragments, is assigned a time slot, and is transmitted in synchronized timed.
+
  
==Pros & Downfaults==
+
Note that not every file named index.dat is a IE History file.
  
TDMA can be wasteful of bandwidth because time slots are allocated to specific conversations whether or not anyone was speaking at the given moment.  There is an enhanced version however, EDTMA, which attempts to correct this problem.  Unlike TDMA which waits to determine whether a subscriber is transmitting, ETDMA assigns subscribers using a dynamic method.  The data is sent through pauses which normal speech contains.  If the subscriber has something they would like to transmit, it is placed as one bit in the buffer queue.  The system then scans the buffer and notices the user has something to transmit, allocating the bandwidth accordinglyHowever, if there is nothing to transmit, it goes to the next subscriber. This technique can be 10 times more efficient as analog transmission of TDMA. 
+
== File Header ==
 +
Every version of Internet Explorer since Internet Explorer 5 has used the same structure for the file header and the individual recordsInternet Explorer history files begin with:
 +
43 6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32
 +
Which represents the ascii string "Client UrlCache MMF Ver 5.2"
  
==Cell Phone Providers==
+
The next field in the file header starts at byte offset 28 and is a four byte representation of the file size.  The number will be stored in [[endianness | little-endian]] format so the numbers must actually be reversed to calculate the value.
  
There are several cell phone companies competing to sell their phones and advertise their network coverage areaThey will primarily be competing within two categories:  TDMA and [[CDMA]].  The pros and cons of TDMA have been mentioned, and the companies that offer TDMA are the following:  AT&T, Cingular, Nextel, T-MobileThe companies that support [[CDMA]] are:  ALLTEL, Amp'd Mobile, Cricket Wireless, ESPN, Quest, Sprint, Verizon, Virgin Mobile.  As we can see, more companies are supporting [[CDMA]].  The question that arises is, what makes the two so different? 
+
Also of interest in the file header is the location of the cache directoriesIn the URL records the cache directories are given as a number, with one representing the first cache directory, two representing the second and so on.  The names of the cache directories are kept at byte offset 64 in the fileEach directory entry is 12 bytes long of which the first eight bytes contain the directory name.
  
 +
== Allocation bitmap ==
 +
The IE History File contains an allocation bitmap starting from offset 0x250 to 0x4000.
  
==TDMA Vs. [[CDMA]]==
+
== Record Formats ==
  
TDMA is better for international plans and debately has better battery life.  [[CDMA]] claims it has better battery life and coverage, however, Cingular is supposed to have the best coverage area and that is TDMA.  All of this started however ever since [[CDMA]] was introduced in 1989, and the wireless world has been in debate over merits of TDMA and [[CDMA]].  Those who are for [[CDMA]] have claimed that its technology has bandwidth efficiency of up to 13 times that of TDMA and between 20 to 40 times that of analog transmission.  Furthermore, [[CDMA]] lovers say its spread spectrum technology is more secure and offers higher transmission quality than TDMA because of TDMA's increased resistance to multipath distortion.  
+
Every record has a similar header that consists of 8 bytes.
  
Those who favor TDMA point out that there has been no successful major trial of [[CDMA]] technology that supports the capacities it claims. Not to mention, theoretical improvements in bandwidth efficiency claimed [[CDMA]] is now being approached by enhancements to TDMA technology. TDMA's evolution allows capacity increases of 20 to 40 fold over analog in the near future. [[CDMA]] is a very expensive technology that needs $300,000 per base station, compared to $80,000 for TDMA. Lastly, TDMA is the proven leader as the most economical digital migration path for existing AMPS networksNo one has the final word in this debate, however, it is evident that TDMA will remain the dominant technology in the wireless market.
+
<pre>typedef struct _RECORD_HEADER {
 +
  /* 000 */ char        Signature[4];
 +
  /* 004 */ uint32_t    AmountOfBlocksInRecord;
 +
} RECORD_HEADER;</pre>
 +
 
 +
The size of the record can be determined from the amount of blocks in the record; per default the block size is 128 bytes. Therefore, a length of <pre>05 00 00 00</pre> would indicate five blocks (because the number is stored in little-endian format) of 128 bytes for a total record length of 640 bytes.
 +
 
 +
The blocks that make up a record can have slack space.
 +
 
 +
Currently 4 types of records are known:
 +
* URL
 +
* REDR
 +
* HASH
 +
* LEAK
 +
 
 +
=== URL Records ===
 +
 
 +
These records indicate URIs that were actually requested. They contain the location and additional data like the web server's HTTP response. They begin with the header, in hexadecimal:
 +
 
 +
<pre>55 52 4C 20</pre>
 +
This corresponds to the string <tt>URL</tt> followed by a space.
 +
 
 +
The definition for the structure in C99 format:
 +
 
 +
<pre>typedef struct _URL_RECORD_HEADER {
 +
  /* 000 */ char        Signature[4];
 +
  /* 004 */ uint32_t    AmountOfBlocksInRecord;
 +
  /* 008 */ FILETIME    LastModified;
 +
  /* 010 */ FILETIME    LastAccessed;
 +
  /* 018 */ FATTIME    Expires;
 +
  /* 01c */
 +
  // Not finished yet
 +
} URL_RECORD_HEADER;</pre>
 +
 
 +
<pre>
 +
typedef struct _FILETIME {
 +
  /* 000 */ uint32_t    lower;
 +
  /* 004 */ uint32_t    upper;
 +
} FILETIME;</pre>
 +
 
 +
<pre>
 +
typedef struct _FATTIME {
 +
  /* 000 */ uint16_t    date;
 +
  /* 002 */ uint16_t    time;
 +
} FATTIME;</pre>
 +
 
 +
The actual interpretation of the "LastModified" and "LastAccessed" fields depends on the type of history file in which the record is contained. As a matter of fact, Internet Explorer uses three different types of history files, namely Daily History, Weekly History, and Main History. Other "index.dat" files are used to store cached copies of visited pages and cookies.
 +
The information concerning how to intepret the dates of these different files can be found on Capt. Steve Bunting's web page at the University of Delaware Computer Forensics Lab (http://128.175.24.251/forensics/default.htm).
 +
Please be aware that most free and/or open source index.dat parsing programs, as well as quite a few commercial forensic tools, are not able to correctly interpret the above dates. More specifically, they interpret all the time and dates as if the records were contained into a Daily History file regardless of the actual type of the file they are stored in.
 +
 
 +
=== REDR Records ===
 +
REDR records are very simple recordsThey simply indicate that the browser was redirected to another site.  REDR records always start with the string REDR (0x52 45  44 52).  The next four bytes are the size of the record in little endian format.  The size will indicate the number 128 byte blocks.
 +
 
 +
At offset 8 from the start of the REDR record is an unknown data field.  It has been confirmed that this is not a date field.
 +
 
 +
16 bytes into the REDR record is the URL that was visited in a null-terminated string.  After the URL, the REDR record appears to be padded with zeros until the end of the 128 byte block.
 +
 
 +
=== HASH Records ===
 +
 
 +
=== LEAK Records ===
  
 
== External Links ==
 
== External Links ==
  
http://en.wikipedia.org/wiki/Time_division_multiple_access <br>
+
* [http://www.cqure.net/wp/?page_id=18 IEHist program for reading index.dat files]
http://www.iec.org/online/tutorials/tdma/topic04.html <br>
+
* [http://www.milincorporated.com/a3_index.dat.html What is in Index.dat files]
http://www.cellphoneinfo.com/index.html
+
* [http://www.foundstone.com/us/pdf/wp_index_dat.pdf Detailed analysis of index.dat file format]
 +
* [http://downloads.sourceforge.net/sourceforge/libmsiecf/MSIE_Cache_File_format.pdf MSIE Cache File (index.dat) format specification]
 +
 
 +
[[Category:File Formats]]

Revision as of 03:23, 6 June 2009

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Internet Explorer as of version 4 stores the web browsing history in files called index.dat. The files contain multiple records.

MSIE version 3 probably uses similar records in its History (Cache) files.

File Locations

Internet Explorer history files keep a record of URLs that the browser has visited, cookies that were created by these sites, and any temporary internet files that were downloaded by the site visit. As a result, Internet Explorer history files are kept in several locations. Regardless of the information stored in the file, the file is named index.dat.

On Windows 95/98 these files were located in the following locations: %systemdir%\Temporary Internet Files\Content.ie5 %systemdir%\Cookies %systemdir%\History\History.ie5

On Windows 2000/XP the file locations have changed: %systemdir%\Documents and Settings\%username%\Local Settings\Temporary Internet Files\Content.ie5 %systemdir%\Documents and Settings\%username%\Cookies %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5

Internet Explorer also keeps daily, weekly, and monthly history logs that will be located in subfolders of %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5. The folders will be named MSHist<two-digit number><starting four-digit year><starting two-digit month><starting two-digit day><ending four-digit year><ending two-digit month><ending two-digit day>. For example, the folder containing data from March 26, 2008 to March 27, 2008 might be named MSHist012008032620080327.

Note that not every file named index.dat is a IE History file.

File Header

Every version of Internet Explorer since Internet Explorer 5 has used the same structure for the file header and the individual records. Internet Explorer history files begin with:

43 6c 69 65 6e 74 20 55 72 6c 43 61 63 68 65 20 4d 4d 46 20 56 65 72 20 35 2e 32

Which represents the ascii string "Client UrlCache MMF Ver 5.2"

The next field in the file header starts at byte offset 28 and is a four byte representation of the file size. The number will be stored in little-endian format so the numbers must actually be reversed to calculate the value.

Also of interest in the file header is the location of the cache directories. In the URL records the cache directories are given as a number, with one representing the first cache directory, two representing the second and so on. The names of the cache directories are kept at byte offset 64 in the file. Each directory entry is 12 bytes long of which the first eight bytes contain the directory name.

Allocation bitmap

The IE History File contains an allocation bitmap starting from offset 0x250 to 0x4000.

Record Formats

Every record has a similar header that consists of 8 bytes.

typedef struct _RECORD_HEADER {
  /* 000 */ char        Signature[4];
  /* 004 */ uint32_t    AmountOfBlocksInRecord;
} RECORD_HEADER;
The size of the record can be determined from the amount of blocks in the record; per default the block size is 128 bytes. Therefore, a length of
05 00 00 00
would indicate five blocks (because the number is stored in little-endian format) of 128 bytes for a total record length of 640 bytes.

The blocks that make up a record can have slack space.

Currently 4 types of records are known:

  • URL
  • REDR
  • HASH
  • LEAK

URL Records

These records indicate URIs that were actually requested. They contain the location and additional data like the web server's HTTP response. They begin with the header, in hexadecimal:

55 52 4C 20

This corresponds to the string URL followed by a space.

The definition for the structure in C99 format:

typedef struct _URL_RECORD_HEADER {
  /* 000 */ char        Signature[4];
  /* 004 */ uint32_t    AmountOfBlocksInRecord;
  /* 008 */ FILETIME    LastModified;
  /* 010 */ FILETIME    LastAccessed;
  /* 018 */ FATTIME     Expires;
  /* 01c */ 
  // Not finished yet
} URL_RECORD_HEADER;
typedef struct _FILETIME {
  /* 000 */ uint32_t    lower;
  /* 004 */ uint32_t    upper;
} FILETIME;
typedef struct _FATTIME {
  /* 000 */ uint16_t    date;
  /* 002 */ uint16_t    time;
} FATTIME;

The actual interpretation of the "LastModified" and "LastAccessed" fields depends on the type of history file in which the record is contained. As a matter of fact, Internet Explorer uses three different types of history files, namely Daily History, Weekly History, and Main History. Other "index.dat" files are used to store cached copies of visited pages and cookies. The information concerning how to intepret the dates of these different files can be found on Capt. Steve Bunting's web page at the University of Delaware Computer Forensics Lab (http://128.175.24.251/forensics/default.htm). Please be aware that most free and/or open source index.dat parsing programs, as well as quite a few commercial forensic tools, are not able to correctly interpret the above dates. More specifically, they interpret all the time and dates as if the records were contained into a Daily History file regardless of the actual type of the file they are stored in.

REDR Records

REDR records are very simple records. They simply indicate that the browser was redirected to another site. REDR records always start with the string REDR (0x52 45 44 52). The next four bytes are the size of the record in little endian format. The size will indicate the number 128 byte blocks.

At offset 8 from the start of the REDR record is an unknown data field. It has been confirmed that this is not a date field.

16 bytes into the REDR record is the URL that was visited in a null-terminated string. After the URL, the REDR record appears to be padded with zeros until the end of the 128 byte block.

HASH Records

LEAK Records

External Links