Summary: We'll look at a few ways that might be possible, but unlikely, to undelete the History.
|
I was wondering if IE's "History" (using CTRL-H) can be retrieved on my computer somewhere once it's been deleted. Or once it's deleted is it gone? Can you please let me know if I can retrieve the deleted history? |
In short - probably not. There are a couple of approaches that might work, if you're lucky, and perhaps desperate enough.
First, we need to locate where the history is kept.
•
For Windows XP, Internet Explorer's history is kept in a per-user directory underneath "\Documents and Settings". Assuming a default location, that would be:
c:\Documents and Settings\Username\Local Settings\History
"Username" would be replaced by your login user name. So mine, for example, would be "c:\Documents and Settings\LeoN\Local Settings\History".
Note: the "History" directory is marked "invisible" by default, so it's likely that you won't find it by default. You'll need to enable viewing hidden files in Windows Explorer, or searching for Hidden Files when you perform a search. In a Command Prompt, you can simply "CD" to it, even if you don't see it.
The easiest way is to simply recover the contents of that directory, including all subdirectories, from a recent backup. If you've been making regular backups of your full system, as recommended, then you can simply use your backup utility to restore only those directories, after which you should be able to restart IE and have the old history restored.
Alternately, and with an even lower chance of success is to see if you can "undelete" an older version of the files found in that directory. If you get very lucky you might be able to undelete or recover a file that has the history you want. I do not recommend this approach, simply because the chances of it working are so very low.
Ultimately, I believe that the chances for successfully recovering this data is so low, that it is effectively zero.
I will throw out one last approach - but it's expensive, potentially time consuming, and really only for the most dire of circumstances. It is sometimes possible, using advanced data recovery techniques, for a data recovery service to recover this type of data. You'd be sending them your hard disk, and you'd be writing a fairly large check. There are many factors involved, and it's definitely not as easy as you might see on TV, but it can, sometimes, be done.
Related:
-
I deleted a file by mistake - can I get it back? It is sometimes possible to recover a file deleted by accident. Stop using the disk, check your recycle bin, and perhaps pull out an undelete utility.
-
What backup program should I use? Backing up your computer's data is critical. What program should you use? There are many, but the best is whichever one you actually will use.
Article C2543 - February 4, 2006
Hello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does't delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does't contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.
I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.
Posted by: Dmitry at January 15, 2007 5:01 AMWindows keeps IE history in the index.dat files which are locked and can't be deleted in Windows platform.
Posted by: Arthur at February 23, 2007 3:25 AMHistory Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller
Leo,
Posted by: Steve Burgess at October 19, 2007 8:48 AMGood article, and good comments. There's something that I think may have been left out, however. The discussion has centered around deleted index.dat files, but there is also a lot of Internet history left lying around when the History truncates its file by default. The user may have one or two weeks of history kept, but the old history doesn't just go away. It gets truncated, and orphaned off into unallocated space. So the text containing those history entries is a rich source of information for computer forensics guys like me. It is not unusual for me to find hundreds of thousands of old Internet history entries (I'm not exaggerating) by using various forensic utilities. There is information about this and related issues on my article pages - I hope it's okay to put that reference here: http://www.burgessforensics.com/articles.php
Thanks for your good work!
-Steve
Hi Leo great site thanks could either you or warren answer this one?
Posted by: jo at March 22, 2008 11:58 AMTo Warren Whitney
re using system restore
Please can you tell me exaclty how you used system restore. I have windows xp etc and have carried out the system explore procedure and sure enough the list (ie the list: 'x weeks ago') has returned & for a minute I rejoiced but they do not expand ie they seem to be empty.
All your internet history is kept by Windows in the locations already mentioned. Obviously it's possible to see part or all by undeleting files which is how police see what sites you've visited.
Posted by: Poxy Pig at December 13, 2008 10:58 AMWhether it's possible to reconstruct it in a fashion which you can re-use is another question.
My Internet Explorer (v6) not only saves web sites but records every file I've opened on my own computer. Is there a way of stopping this?
Also, when I delete a just a few items from the history, one of IE's many bugs causes the whole history to disappear after the fourth or fifth item is deleted! What happens to it?
When I am using internet explorer and go to view then history, it only shows today's history as I deleted the tab that shows last weeks history. I regret deleting it and it want it to show last weeks history again. How do I get it to go back and show last weeks history again? This was deleted a while ago and I went back to my earlist restore point and it still wont show. Please help!
-Jo
Posted by: Jo at March 12, 2009 7:31 AMI use Windows Vista, and have no history in IE. The dropdown is simply empty. I am not deleting it, and this situation has persisted through the recent installation of IE 8. I'm wondering if the history file is in a directory that can't be written to. This is my own personal computer, so I should have full access, but I've noticed there are folders Vista won't let me into. Is this the problem? Thanks,
Posted by: Mark at April 21, 2009 11:18 AMEasy job!
I backup my system on regular basis.
Makes recovery so easy.
A lesson I learned a long time ago that you backup your system, period.
Posted by: Eric at June 14, 2009 6:46 AMVery Interesting & Informative!
Is there a way to keep track of urls visited & their respective viewing time durations?
Posted by: Prof. JimBordonaro at August 21, 2009 8:25 AMThank you for this info. Spent ages trying to find the location of IE's history files!
Cheers!
Posted by: Julian at October 27, 2009 1:21 PM