Ask Leo! by Leo A. Notenboom

Can Internet Explorer's History be undeleted?

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Internet

Summary: We'll look at a few ways that might be possible, but unlikely, to undelete the History.

I was wondering if IE's "History" (using CTRL-H) can be retrieved on my computer somewhere once it's been deleted. Or once it's deleted is it gone? Can you please let me know if I can retrieve the deleted history?

In short - probably not. There are a couple of approaches that might work, if you're lucky, and perhaps desperate enough.

First, we need to locate where the history is kept.

For Windows XP, Internet Explorer's history is kept in a per-user directory underneath "\Documents and Settings". Assuming a default location, that would be:

c:\Documents and Settings\Username\Local Settings\History
"The easiest way is to simply recover the contents of that directory, including all subdirectories, from a recent backup."

"Username" would be replaced by your login user name. So mine, for example, would be "c:\Documents and Settings\LeoN\Local Settings\History".

Note: the "History" directory is marked "invisible" by default, so it's likely that you won't find it by default. You'll need to enable viewing hidden files in Windows Explorer, or searching for Hidden Files when you perform a search. In a Command Prompt, you can simply "CD" to it, even if you don't see it.

The easiest way is to simply recover the contents of that directory, including all subdirectories, from a recent backup. If you've been making regular backups of your full system, as recommended, then you can simply use your backup utility to restore only those directories, after which you should be able to restart IE and have the old history restored.

Alternately, and with an even lower chance of success is to see if you can "undelete" an older version of the files found in that directory. If you get very lucky you might be able to undelete or recover a file that has the history you want. I do not recommend this approach, simply because the chances of it working are so very low.

Ultimately, I believe that the chances for successfully recovering this data is so low, that it is effectively zero.

I will throw out one last approach - but it's expensive, potentially time consuming, and really only for the most dire of circumstances. It is sometimes possible, using advanced data recovery techniques, for a data recovery service to recover this type of data. You'd be sending them your hard disk, and you'd be writing a fairly large check. There are many factors involved, and it's definitely not as easy as you might see on TV, but it can, sometimes, be done.

Related:

Article C2543 - February 4, 2006

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:


Why Subscribe?

Recent Comments
14 Comments

Hello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does't delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does't contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.

I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.

Posted by: Dmitry at January 15, 2007 5:01 AM

Windows keeps IE history in the index.dat files which are locked and can't be deleted in Windows platform.
History Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller

Posted by: Arthur at February 23, 2007 3:25 AM

Leo,
Good article, and good comments. There's something that I think may have been left out, however. The discussion has centered around deleted index.dat files, but there is also a lot of Internet history left lying around when the History truncates its file by default. The user may have one or two weeks of history kept, but the old history doesn't just go away. It gets truncated, and orphaned off into unallocated space. So the text containing those history entries is a rich source of information for computer forensics guys like me. It is not unusual for me to find hundreds of thousands of old Internet history entries (I'm not exaggerating) by using various forensic utilities. There is information about this and related issues on my article pages - I hope it's okay to put that reference here: http://www.burgessforensics.com/articles.php
Thanks for your good work!
-Steve

Posted by: Steve Burgess at October 19, 2007 8:48 AM

Hi Leo great site thanks could either you or warren answer this one?
To Warren Whitney
re using system restore
Please can you tell me exaclty how you used system restore. I have windows xp etc and have carried out the system explore procedure and sure enough the list (ie the list: 'x weeks ago') has returned & for a minute I rejoiced but they do not expand ie they seem to be empty.

Posted by: jo at March 22, 2008 11:58 AM

All your internet history is kept by Windows in the locations already mentioned. Obviously it's possible to see part or all by undeleting files which is how police see what sites you've visited.
Whether it's possible to reconstruct it in a fashion which you can re-use is another question.
My Internet Explorer (v6) not only saves web sites but records every file I've opened on my own computer. Is there a way of stopping this?
Also, when I delete a just a few items from the history, one of IE's many bugs causes the whole history to disappear after the fourth or fifth item is deleted! What happens to it?

Posted by: Poxy Pig at December 13, 2008 10:58 AM

When I am using internet explorer and go to view then history, it only shows today's history as I deleted the tab that shows last weeks history. I regret deleting it and it want it to show last weeks history again. How do I get it to go back and show last weeks history again? This was deleted a while ago and I went back to my earlist restore point and it still wont show. Please help!

-Jo

Posted by: Jo at March 12, 2009 7:31 AM

I use Windows Vista, and have no history in IE. The dropdown is simply empty. I am not deleting it, and this situation has persisted through the recent installation of IE 8. I'm wondering if the history file is in a directory that can't be written to. This is my own personal computer, so I should have full access, but I've noticed there are folders Vista won't let me into. Is this the problem? Thanks,

Posted by: Mark at April 21, 2009 11:18 AM

Easy job!

I backup my system on regular basis.

Makes recovery so easy.

A lesson I learned a long time ago that you backup your system, period.

Posted by: Eric at June 14, 2009 6:46 AM

Very Interesting & Informative!

Is there a way to keep track of urls visited & their respective viewing time durations?

Posted by: Prof. JimBordonaro at August 21, 2009 8:25 AM

Thank you for this info. Spent ages trying to find the location of IE's history files!

Cheers!

Posted by: Julian at October 27, 2009 1:21 PM

Post a comment on "Can Internet Explorer's History be undeleted?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!

(you may use HTML tags for style)

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

  • Read the article at the top of this page. If your comment shows you didn't, it'll be deleted and ignored.

  • Comment only on this article. Use the Google search box at the top of the page if you have a question about something else.

  • Don't include personal information in the comment. No email addresses. No phone numbers. No physical addresses.

  • Don't spam. Excessive links to unrelated sites within a comment or across multiple comments will cause all such comments to be removed.

  • Don't ask me to recover lost passwords or hacked accounts. I can't, and those comments will be deleted.

  • I can't respond to every comment. And I can't vouch for the accuracy of others who do.

Please wait. Your comment is being processed ...


Question? Ask Leo!