Solved

Need to Restore Internet History Folder!

Posted on 2004-10-18
14
1,788 Views
Last Modified: 2012-06-27
I copied the Internet History folder of an employee who was abusing her internet privileges   The next business day, she deleted her internet history, including her offline content and cookies.  I tried to "re-copy" the History folder but it won't let me.  I have the History Folder, how can I view the websites she visited?  I know for a fact she visited over 45 websites during one business day!  We have an upcoming hearing regarding this employee and I want to be able to print out this information.   Whomever can help me be able to restore this information to be able to print it out, is worthy of the 500 points I'm offering!
0
Comment
Question by:anaed
  • 8
  • 6
14 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
Hello anaed =)

>> I tried to "re-copy" the History folder but it won't let me

Boot ur system in safemode, and login with the Administrator account
now try to copy the history folder to her account or to another account, it shud be copied now without problems :)
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
and to print out the contents of the History folder, u can use this tool >> http://www.snapfiles.com/get/printfolders.html
0
 

Author Comment

by:anaed
Comment Utility
I rebooted in safemode.  However, in safemode, you
 can't access the [local settings] folder c:\documentandsettings\jat\localsettings\ which is where I see the history is located on everyone else's computer.  If I try to copy the History folder just under c:\documentsandsettings\jat (jat being the username) ... when I reboot in regular mode, I still don't see her previous history.

Am I trying to copy it to the wrong location?

JAT has been gone since 8/23/04.  I changed the system clock to reflect it is 8/22/04 (the date I copied her history), but that doesnt seem to make a difference.

I also downloaded a copy of that software recommended and while it did take the History.IE5 folder and it's subfolders and convert them to text, they don't show any of the websites she visited - only stuff like this:

MSHIST012004061520040616     DIR   8/23/2004      10:44:39 AM
MSHIST012004080920040816     DIR   8/23/2004      10:44:39 AM
MSHIST012004081620040817     DIR   8/23/2004      10:44:39 AM


or
CAXEGDDH         (0 bytes)       8/19/2004      11:46:35 AM
CAXVJB2H    0.0 KB (0 bytes)   8/20/2004      1:47:34 PM
CAY2U38I     0.0 KB (0 bytes)   8/20/2004      10:16:43 AM
CAY3OHQZ   0.0 KB (0 bytes)   8/20/2004      12:29:04 PM

Any further help is greatly appreciated....
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
>> However, in safemode, you can't access the [local settings] folder c:\documentandsettings\jat\localsettings\

Why,,,, why cant u access the Local Settings folder,,,,, u shud be able to access it, everyone can access it via safemode :)
Have u turned on the Show Hidden Files feauture from Tools>Folder Options>View, in safemode to see the Local Settings folder :)
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
and when u open History folder, u can see the subfolders there as, 1 Week Ago, Today, Yesterday etc etc
open any of these folders, and now u can see all the websites, now print with that tool, it shud convert these websites(contents of this folder) to text !!
0
 

Author Comment

by:anaed
Comment Utility
Okay - here's what I've done: (and yes, I discovered I didn't have view hidden files on).  (Haste makes waste!)

I created a new user account called "JAT" on my own machine (for convenience sake).

I rebooted in safemode under my own Admin username "DLB".

I went to the network directory where I copied various files from JAT's workstation the day before she did a mass deletion which included the following:

C:\documentsandsettings\jat\Local Settings\Temp
and
c:\documents and settings\jat\local settings\temporary internet files folders

I also have 2 folders:

History\History.IE5  
and
Favorites

Since I created a new JAT user account on my personal workstation, I was able to put those above-referenced folders in the corresponding directories

c:\documentsandsettings\jat\localsettings\ .....

I logged out and back in under username JAT
and went to the internet and clicked on "History".

It only gives me a history for TODAY.

Why is it not reading what I copied?
Did I not copy enough from her computer (before she did her mass deletion) to be able to restore this stuff?  I simply overwrote the existing files with these old files -- so I presume I'm restoring them to the proper location.

Help?
0
 

Author Comment

by:anaed
Comment Utility
Also,

If I just click on the "History" folder, there's a subfolder "History.IE5".  Within that folder are various subfolders:

MSHisto012004061520040816
MSHisto012004081620040817
MSHisto012004081620040818
MSHisto012004081620040819
MSHisto012004081620040820
MSHisto012004081620040821

within each of those folders is only one file:
index.dat each.

The only thing that snap program gives me is a printout that it's an index file and the date.  No "website" information.

Is website content stored in "Offline Content?" I didn't copy her "Offline content folder" before she deleted it.

Also, I don't see "Today, Last Week, 2 Weeks ago." when I go to look at it, just what I described above.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
i can understand everything u are doing, and u are doing in a very right way, nothing is wrong anywhere :)
but just tell me one thing,,, when u created the JAT account,,,, did u logged in with this user for once before copying the data to its profile folder ??
0
 

Author Comment

by:anaed
Comment Utility
Good question -

No I don't believe I did log in using JAT's login after I created her account.  I specifically did not want I.E. to create a new history before I had a chance to copy the "old" history to her "clean" account.

0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
that's the mistake,,,, login with it first and let the system to create all of its new folders,,,,, then restart to login in safmeode with ur admin account, and now "Replace" those newly created folders with the ones u copied from her account !!

the ideal idea of copying an old data to a new user is by "Replacing" the new data, coz these folders get created when the new user login for the first time...... and if u put something already there before loggin in, and then login, the copied folder get replaced by the newly created folders and thus u will get all of them as freshly created..... understand now ?? :)
0
 

Author Comment

by:anaed
Comment Utility
Okay,

I deleted the JAT account entirely and started over.

I created a new JAT account & mapped network drives (so I could copy the History file I have on the server).

I then logged into the internet - to create a new history for today (August 22, 2004).

I rebooted in safe mode.

I logged into JAT's account (as it had administrator rights).

Went to Documents & Settings\JAT\Local Settings\  and saw a "History" folder.

***I clicked on that history folder and yes, it shows me what history I had for TODAY.***

I then backed out of that History folder, and pasted the original History folder to that directory.  It of course advised that a folder already existed and did I want to replace it and it's contents.  I selected, "Yes."

I then clicked on the folder and instead of opening to show me the history for Today (as it had moments earlier)... it shows me a subfolder "History.IE5".  (Nothing else).

When I click on "History.IE5" it shows me subfolders as follows:

MSHist012004061520040816
MSHist012004061520040817
and so on.

When I copied her History Folder originally, there apparently was a subfolder called History.IE5.

I never thought anything of it, but it is apparently the reason I cannot simply click on the history folder and see Today, Last Week, 2 Weeks ago.

What gives?!

I even tried moving those subfolders up a level so that the History.IE5 folder wasn't the reason I couldn't see "Today, Last Week, 2 Weeks ago".

Any ideas?

Should I have copied more than just her "History" folder? in order to restore it?
0
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 500 total points
Comment Utility
dont know what's happening with u coz i always do it and it always works =\

say i want to format my C: drive which has my profile folder with the history folder in it,,,, i have naother D: partition for backup !!
So to backup the history folder, i copy it to D: drive, now when i open it i can see the ContentIE folder and not Today Yesterday etc etc,,,,, ok no problem !!
i go ahead and format and reinstall XP, now i have a new user with a new histroy folder, which has just TODAY in it !!
now i boot into safemode, and login as Administrator(not with my user), then i goto D: drive, copy the Histroy folder, comes back to my profile in C: and paste here it, it says do u want to replace, i say OK, and it replaces it !!
then i reboot back in normal mode and connects to internet, click the History tab and i have all my old history websites there,,,, and now when i go and open history from C: drive in my profile, it has not listed Today or anything, but all the websites itself, and as i keep on visiting the extra websites, it keeps adding the new ones per today, yesterday, etc etc and deleting the old ones !!
and i just cannot understand why this is not happening with u :-?

ok let's take the other route..... u have those subfolders with those index.dat files, right ??
then download this tool called Index.dat Viewer >> http://www.exits.ro/index-dat-viewer.html
Open those subfolders' index.dat files in it and check if u can view the websites thru it or not ?? :)
0
 

Author Comment

by:anaed
Comment Utility
Although I can't figure out why you can view your internet history, and I can't, I did download that index-dat viewer and at long last! it shows me what websites she was on the last week of her employment!  

I have a curious question tho - the viewer lists the date and TIME she accessed sites, which is inaccurate.  It shows her accessing the sites sometimes at 7:00 - 8:00 or 11:00 p.m.  even Midnight.  Clearly the time is wrong as I matched when she clocked in and out.  She doesn't have access to the building after hours, so,  I'm disappointed the time of day is wrong.  I can't rely on the "time of day" she was browsing the internet, just the fact she used her internet for everything BUT work.

Any ideas why the time might be wrong??  Her computer clock was not wrong, and some of the times of day coincide with her work schedule.  Just a curious thought.

Thank you for your assistance, I would award more points if it let me.   Thanks again!
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
hmmmmm the viewer gets the information which is stored in the index.dat....
so its quite impossible to tell if viewer is telling wrong or index.dat has stored the time and date wrongly :-?

can u try this,,,,, download and use this tool >> http://www.spychecker.com/program/indexdatsuite.html
Does it report the time and data as reported by Index.dat viewer or different from it ??
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now