XP's hidden history!

Lenny

Microsoft's Hidden Files in WinXP Pro - IE History
By E-man / @ Astalavista Group

---

If you've read the article by "The Riddler" (which was also posted
at Astalavista) you will know what I'm talking about.
If not, then here it is...

MSIE (e.g. Microsoft Internet Explorer) is known to store your
entire history inside a HIDDEN file somewhere in your comp for
unknown reasons (or should I say, Unproven reasons).
OK, then we just click on "clear history" and "delete files" no?
NO! it might seem like it erased the history, but it didnt.

It is stored inside a file called "Index.DAT", which is Hidden.
But not hidden in the regular way, even if you enalbe the "view hidden files"
option, you will still not be able to see it or even search for it.


Here is how to get that file:
(View hidden files must be on)

Go to:

<Drive where you installed WinXP>/Documents and Settings/<Your user folder>/Local Settings/

See that "Temporary Internet Files" ?
Right click on it. Notice anything missing?
That's right! no "Search" option! Very strange.

Go to MSIE and clean ALL your history / temporary internet files.
(this is done by going to the "Tools" menu and clicking on "Delete Files" and "Clean history")

Now enter that folder again.
Nothing but cookies right?
Wrong again!
Go up one level and right click the "Temporary Internet Files" folder and then on "Send to".
Now choose "My documents" (easiest choice). and go to the "My documents" folder.

There popped the "Temporary Internet Files" folder, get inside that folder...
Suprise! No cookies no nothing!
Just 2 folder and a "Desktop.ini" file.
Get inside the "Content.IE5" folder, and there's that "Index.dat"!
You will probably find some more folders there, they will have your temporary (?) internet files in them.

Open the "Index.dat" in any text editor (notepad is good) and be amazed.
its a list of files that your MSIE downloaded from the websites you've visited, now pull the scroll bar
to the right, and there you have it, the list of websites you've visited!

You can see that windows also stores the name of the user who visited these website near the name of the file
that was downloaded from them.

Want to erase the files? nah, MS probably have them by now.
I sugest this will be the last time you use MSIE.

Best Regards.

You may distribute this article only if you keep its original form.
This article is under my copyrights.

-

www.nu-dawn.ca/deletehidden.zip

Lenny

I get a blank zip in the above download, if it don't work, use this one
http://evil.dynip.com/spider116.zip

^^
download this one, it seems to work for Windows 95/98/ME

flamegrill

afaik that index.dat is what IE uses to reference the internet cache it stores. it would be a map of sorts so as it can see if the page u have just requested is available locally.

its not a big deal and if u were a dos kid of any kind you would have see that file a long time ago :P

its been there since IE 4.

Regards,

Paul

yellum

Its been there since IE3 and Win95. Theres a few of those logging files around the MS OSs. Not a new thing at all. Fravia - http://searchlores.org was one of the first to bring this to peoples attention.

Static M.e.

I use a program called Cleandisk 2002 that clears all your files
secret and all , afik its only for win98 though ,but its a handy tool
that clears away alot of junk

Cant think of the url at the moment though sorry , but if i find it ill
post it..
Now for some rumors
I heard before that the purpose of these files is for the FBI ( scary music starts ) to check peoples history on machines they imponded ie. hackers / perverts /weirdos
And although the guys would think there smart deleting cookies and emptying folders and all, the Fbi would have them anyway
and so look better for there amazing info they uncovered
This was all back with win 95 though and was meant to have been removed with newer versions of win .ie .98 , but sure
im sure theyll get around to it soon.