I was wondering if IE's "History" (using CTRL-H) can be retrieved on my computer somewhere once it's been deleted. Or once it's deleted is it gone? Can you please let me know if I can retrieve the deleted history? In short - probably not. There are a couple of approaches that might work, if you're lucky, and perhaps desperate enough. First, we need to locate where the history is kept. For Windows XP, Internet Explorer's history is kept in a per-user directory underneath "\Documents and Settings". Assuming a default locations, that would be: c:\Documents and Settings\Username\Local Settings\History "The easiest way is to simply recover the contents of that directory,
including all subdirectories, from a recent backup."
"Username" would be replaced by your login user name. So mine, for example, would be "c:\Documents and Settings\LeoN\Local Settings\History". Note: the "History" directory is marked "invisible" by default, so it's likely that you won't find it by default. You'll need to enable viewing hidden files in Windows Explorer, or searching for Hidden Files when you perform a search. In a Command Prompt, you can simply "CD" to it, even if you don't see it. The easiest way is to simply recover the contents of that directory, including all subdirectories, from a recent backup. If you've been making regular backups of your full system, as recommended, then you can simply use your backup utility to restore only those directories, after which you should be able to restart IE and have the old history restored. Alternated, and with an even lower chance of success is to see if you can "undelete" an older version of the files found in that directory. If you get very lucky you might be able to undelete or recover a file that has the history you want. I do not recommend this approach, simply because the chances of it working are so very low. Ultimately, I believe that the chances for successfully recovering this data is so low, that it is effectively zero. I will throw out one last approach - but it's expensive, potentially time consuming, and really only for the most dire of circumstances. It is sometimes possible, using advanced data recovery techniques, for a data recovery service to recover this type of data. You'd be sending them your hard disk, and you'll be writing a fairly large check. There are many factors involved, and it's definitely not as easy as you might see on TV, but it can, sometimes, be done. Related:
Article 9767 | Posted February 4, 2006 |
Stay Informed Archives Advertisers |
•
So how can you delete the index.dat file?
Posted by: nvjksdhfuarsh at September 12, 2006 9:27 AMIn reference to Posted by: Warren Whitney at July 26, 2006 05:35 AM, does doing a system restore affect anything else? How far back will it retrieve the internet history?
Posted by: Renee at November 8, 2006 9:12 AMHello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does't delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does't contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.
I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.
Posted by: Dmitry at January 15, 2007 5:01 AMI want to hide my IE history from my network administrator.
Posted by: Leo at January 20, 2007 9:18 PMPlease let me know how I can achieve this
Windows keeps IE history in the index.dat files which are locked and can't be deleted in Windows platform.
Posted by: Arthur at February 23, 2007 3:25 AMHistory Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller
Re:IE history in the index.dat files which are locked and can't be deleted in Windows platform".
Posted by: Peter Hess at July 27, 2007 7:24 PMOpening new administrator account and then deleting previous administrator account and files, effectively deletes all index.dat files. Yes/No??
Leo,
Posted by: Steve Burgess at October 19, 2007 8:48 AMGood article, and good comments. There's something that I think may have been left out, however. The discussion has centered around deleted index.dat files, but there is also a lot of Internet history left lying around when the History truncates its file by default. The user may have one or two weeks of history kept, but the old history doesn't just go away. It gets truncated, and orphaned off into unallocated space. So the text containing those history entries is a rich source of information for computer forensics guys like me. It is not unusual for me to find hundreds of thousands of old Internet history entries (I'm not exaggerating) by using various forensic utilities. There is information about this and related issues on my article pages - I hope it's okay to put that reference here: http://www.burgessforensics.com/articles.php
Thanks for your good work!
-Steve
is there any way I can see the last time someone deleted the internet history, something in the command promt that I can type to see when it was last physically deleted by a user?
Posted by: Bubba R at November 20, 2007 4:12 PMHi Leo great site thanks could either you or warren answer this one?
Posted by: jo at March 22, 2008 11:58 AMTo Warren Whitney
re using system restore
Please can you tell me exaclty how you used system restore. I have windows xp etc and have carried out the system explore procedure and sure enough the list (ie the list: 'x weeks ago') has returned & for a minute I rejoiced but they do not expand ie they seem to be empty.
Leo - Can IE History be permanently DELETED?
Posted by: kristina at October 1, 2008 4:56 PM