Helping people with computers... one answer at a time.

Recovering browser history from a machine that is being used can be tricky as the necessary files could be deleted and the space that they occupied overwritten.

I'm trying to figure out if it's possible to recover web pages that were accessed on a computer on a specific date. I need this information to try and prove a timeline in a legal case in which I'm involved. The computer was using the newest version of Windows. I'm willing to take it to a computer tech and spend the money; I'm just curious if it can be done. Any assistance would be much appreciated.

In this excerpt from Answercast #40, I look at the chances of recovering browser history from a machine that is being used.

Finding browser history

So, unfortunately, this is one of those situations where there is no yes-or-no answer. There is only a maybe.

What it boils down to is that if the history was enabled on that particular browser (which it probably was), then perhaps you would be able to find in that history the list of websites that were accessed over time. Including on a specific date.

Cached website content

Whether you would be able to access the contents of those pages as they were on that particular date is much more vague.

The problem is that the contents are cached in the browser cache. The browser cache automatically empties itself the more that it's used.

In other words:

  • The more you download;

  • The more older stuff is moved out of the way to make room in the cache for the things that are coming in.

So the longer you continue to use that computer or that browser specifically after the date in question, the less likely that you'll be able to actually see the contents of web pages as they were on that date.

However, there's a good chance that the list of URLs at least may still be in the history window.

History can be deleted

Now, there's particularly interesting case where the person using that browser, if they suspected that this might be an issue at some time, they may have deleted the history.

If they've done so, the answer is still not quite yes or no. It's probably no and it gets to be more no the longer you continue to use that computer in any form.

What happens when they delete the history is that:

  • A file on the disk gets altered.
  • It gets deleted or it gets emptied.
  • That doesn't necessarily mean that the data on the disk is overwritten and, in fact, if it's looked at quickly, it's possible that the information that was deleted could still perhaps be recovered.

The problem is that the longer you use the computer, the higher the probability that the area that used to contain that data would get overwritten by something else.

Steps to recovery

So, in general, the answer to this kind of question boils down to this:

  • One, stop using the computer immediately, as quickly as you can.

Unfortunately, your question came in after a certain amount of time so I'm not particularly hopeful.

  • The other thing, then, is that if the data can be recovered, it might very well take recovery tools.

That's where you end up getting your forensic expert.

Like I said, I can't give you an absolute yes or no, but given the time frames that have been involved so far already and the likelihood that the computer is still being used, if it's not in the history, in the browser, then I'm pretty pessimistic about it being able to be recovered.

Forensic recovery

Whether it's worth it to have a forensic person have a look at the disk really depends on your own needs – and the priority of your needs compared to the costs of having somebody do that.

Like I said, the chance of failure (to me) is kind of high. Not absolute. It is possible. It could happen depending on many things like I've said.

So depending on your own willingness to take that risk of however much a technician might cost you, it may or may not be worth it to you.

End of Answercast #40 Back to – Audio Segment

Article C5654 - August 2, 2012 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

1 Comment
MoreOff
August 10, 2012 5:19 AM

Leo,

I get another Newsletter with answers for computer problems from someone else, where I can click on a Link to see a web page to learn their suggestion about what to do, just as I can on Your Ask-Leo web site.

I've found out that even though I have Bookmarked (Firefox) / Favorites (Internet Explorer) an interesting page, so that I can refer to that page at a later time, that 'later time' when I use my Bookmark to visit the page again, I find that I am not allowed to read the article because it is now for (Paid) Members Only.

So when I read something on their web page that I want to refer to later on, MY 'work around' is to click Print, and select DoPDF to save the page as a .PDF file on my Hard Drive, instead of printing the page with my printer, so that "I" can be able to read that information any time "I" want to.

DoPDF and the CutePDF Writer are two program I have heard about that can do that for me, and I have both (there might be others?), but I like to use DoPDF because it has a Option selection for Small File or High Quality, that the CutePDF Writer program doesn't have.

I use the Small File setting and have put a lot of PDF's on my 250 Gig hard drive and haven't filled it up (yet).

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.