Helping people with computers... one answer at a time.
Recovering browser history from a machine that is being used can be tricky as the necessary files could be deleted and the space that they occupied overwritten.
I'm trying to figure out if it's possible to recover web pages that were accessed on a computer on a specific date. I need this information to try and prove a timeline in a legal case in which I'm involved. The computer was using the newest version of Windows. I'm willing to take it to a computer tech and spend the money; I'm just curious if it can be done. Any assistance would be much appreciated.
In this excerpt from Answercast #40, I look at the chances of recovering browser history from a machine that is being used.
So, unfortunately, this is one of those situations where there is no yes-or-no answer. There is only a maybe.
What it boils down to is that if the history was enabled on that particular browser (which it probably was), then perhaps you would be able to find in that history the list of websites that were accessed over time. Including on a specific date.
Whether you would be able to access the contents of those pages as they were on that particular date is much more vague.
The problem is that the contents are cached in the browser cache. The browser cache automatically empties itself the more that it's used.
In other words:
The more you download;
The more older stuff is moved out of the way to make room in the cache for the things that are coming in.
So the longer you continue to use that computer or that browser specifically after the date in question, the less likely that you'll be able to actually see the contents of web pages as they were on that date.
However, there's a good chance that the list of URLs at least may still be in the history window.
Now, there's particularly interesting case where the person using that browser, if they suspected that this might be an issue at some time, they may have deleted the history.
If they've done so, the answer is still not quite yes or no. It's probably no and it gets to be more no the longer you continue to use that computer in any form.
What happens when they delete the history is that:
The problem is that the longer you use the computer, the higher the probability that the area that used to contain that data would get overwritten by something else.
So, in general, the answer to this kind of question boils down to this:
Unfortunately, your question came in after a certain amount of time so I'm not particularly hopeful.
That's where you end up getting your forensic expert.
Like I said, I can't give you an absolute yes or no, but given the time frames that have been involved so far already and the likelihood that the computer is still being used, if it's not in the history, in the browser, then I'm pretty pessimistic about it being able to be recovered.
Whether it's worth it to have a forensic person have a look at the disk really depends on your own needs – and the priority of your needs compared to the costs of having somebody do that.
Like I said, the chance of failure (to me) is kind of high. Not absolute. It is possible. It could happen depending on many things like I've said.
So depending on your own willingness to take that risk of however much a
technician might cost you, it may or may not be worth it to you.
End of Answercast #40 Back to – Audio Segment
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.