Can Internet Explorer's History be undeleted?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Just a thought ...

I know one program that can nicely check/recover/export the contents of any "index.dat" type of file. It's a CLI application from Foundstone called "pasco"; please see here for the program's description: http://www.foundstone.com/resources/proddesc/pasco.htm and optionally you can download it here: http://www.foundstone.com/resources/termsofuse.htm?file=pasco.zip

best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)

Yes Leo, you're completely right ...

Files can be deleted and can be *deleted*; meaning that you can "recycle" a file (i.e. move it to the Recycle Bin), and then issue an "Empty Recycle Bin" command/operation, which in fact doesn't delete the actual contents of the (physical) file on a hard-disk, but it only makes these areas available for future writes; as Leo has already written in the article.

And in my opinion this is somehow similar to reformatting a partition, i.e. the actual data are not overwritten (like in case of the so-called "low-level" format; where the hard-disk is overwritten by zeros or random patterns), but only "marked" as non-occupied, however, the actual data are physically still intact on the hard-disk and can be therefore easily recovered till this area on hard-disk is written to for the first time after deleting the respective file. But even then the data can be retrieved by forensic professionals; but please don't ask me how, because I simply don't know.

From my own experiences, I would recommend two programs; as first an application called "Handyrecovery": http://www.handyrecovery.com/index.shtml (it was free back then when I've used it, but I think it's not anymore) and "PCInspector - File Recovery": http://www.pcinspector.de/file_recovery/welcome.htm, which is a program that besides recovering deleted files can even resce files from corrupted hard-disks and partitions.

P.S., If anyone is interested, please read the "I ACTUALLY DID IT ... I rescued the data from a totally screwed disk !!" thread: http://episteme.arstechnica.com/eve/ubb.x/a/tpc/f/99609816/m/758006059631, that I opened on ArsTechnica forum back then for more info on how I managed to get most of my data back from a totally corrupted/screwed partition with a PC Inspector - File Recovery program mentioned/linked above.

best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)

In Windows XP SP2 - the history absolutely CAN be restored - by using System Restore. I just did it.

In reference to Posted by: Warren Whitney at July 26, 2006 05:35 AM, does doing a system restore affect anything else? How far back will it retrieve the internet history?

Hello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does't delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does't contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.

I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.

Windows keeps IE history in the index.dat files which are locked and can't be deleted in Windows platform.
History Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller

Leo,
Good article, and good comments. There's something that I think may have been left out, however. The discussion has centered around deleted index.dat files, but there is also a lot of Internet history left lying around when the History truncates its file by default. The user may have one or two weeks of history kept, but the old history doesn't just go away. It gets truncated, and orphaned off into unallocated space. So the text containing those history entries is a rich source of information for computer forensics guys like me. It is not unusual for me to find hundreds of thousands of old Internet history entries (I'm not exaggerating) by using various forensic utilities. There is information about this and related issues on my article pages - I hope it's okay to put that reference here: http://www.burgessforensics.com/articles.php
Thanks for your good work!
-Steve

Hi Leo great site thanks could either you or warren answer this one?
To Warren Whitney
re using system restore
Please can you tell me exaclty how you used system restore. I have windows xp etc and have carried out the system explore procedure and sure enough the list (ie the list: 'x weeks ago') has returned & for a minute I rejoiced but they do not expand ie they seem to be empty.

All your internet history is kept by Windows in the locations already mentioned. Obviously it's possible to see part or all by undeleting files which is how police see what sites you've visited.
Whether it's possible to reconstruct it in a fashion which you can re-use is another question.
My Internet Explorer (v6) not only saves web sites but records every file I've opened on my own computer. Is there a way of stopping this?
Also, when I delete a just a few items from the history, one of IE's many bugs causes the whole history to disappear after the fourth or fifth item is deleted! What happens to it?

When I am using internet explorer and go to view then history, it only shows today's history as I deleted the tab that shows last weeks history. I regret deleting it and it want it to show last weeks history again. How do I get it to go back and show last weeks history again? This was deleted a while ago and I went back to my earlist restore point and it still wont show. Please help!

-Jo

To post a comment on "Can Internet Explorer's History be undeleted?", please return to that article's main page.