Can Internet Explorer's History be undeleted?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Just a thought ...

I know one program that can nicely check/recover/export the contents of any "index.dat" type of file. It's a CLI application from Foundstone called "pasco"; please see here for the program's description: http://www.foundstone.com/resources/proddesc/pasco.htm and optionally you can download it here: http://www.foundstone.com/resources/termsofuse.htm?file=pasco.zip

best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)

Yes Leo, you're completely right ...

Files can be deleted and can be *deleted*; meaning that you can "recycle" a file (i.e. move it to the Recycle Bin), and then issue an "Empty Recycle Bin" command/operation, which in fact doesn't delete the actual contents of the (physical) file on a hard-disk, but it only makes these areas available for future writes; as Leo has already written in the article.

And in my opinion this is somehow similar to reformatting a partition, i.e. the actual data are not overwritten (like in case of the so-called "low-level" format; where the hard-disk is overwritten by zeros or random patterns), but only "marked" as non-occupied, however, the actual data are physically still intact on the hard-disk and can be therefore easily recovered till this area on hard-disk is written to for the first time after deleting the respective file. But even then the data can be retrieved by forensic professionals; but please don't ask me how, because I simply don't know.

From my own experiences, I would recommend two programs; as first an application called "Handyrecovery": http://www.handyrecovery.com/index.shtml (it was free back then when I've used it, but I think it's not anymore) and "PCInspector - File Recovery": http://www.pcinspector.de/file_recovery/welcome.htm, which is a program that besides recovering deleted files can even resce files from corrupted hard-disks and partitions.

P.S., If anyone is interested, please read the "I ACTUALLY DID IT ... I rescued the data from a totally screwed disk !!" thread: http://episteme.arstechnica.com/eve/ubb.x/a/tpc/f/99609816/m/758006059631, that I opened on ArsTechnica forum back then for more info on how I managed to get most of my data back from a totally corrupted/screwed partition with a PC Inspector - File Recovery program mentioned/linked above.

best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)

Great info. Thanks for showing it.

In Windows XP SP2 - the history absolutely CAN be restored - by using System Restore. I just did it.

So how can you delete the index.dat file?

In reference to Posted by: Warren Whitney at July 26, 2006 05:35 AM, does doing a system restore affect anything else? How far back will it retrieve the internet history?

Hello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does't delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does't contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.

I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.

I want to hide my IE history from my network administrator.
Please let me know how I can achieve this

Windows keeps IE history in the index.dat files which are locked and can't be deleted in Windows platform.
History Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller

Re:IE history in the index.dat files which are locked and can't be deleted in Windows platform".
Opening new administrator account and then deleting previous administrator account and files, effectively deletes all index.dat files. Yes/No??

To post a comment on "Can Internet Explorer's History be undeleted?", please return to that article's main page.