Need to Restore Internet History Folder!

Hello anaed =)

>> I tried to "re-copy" the History folder but it won't let me

Boot ur system in safemode, and login with the Administrator account
now try to copy the history folder to her account or to another account, it shud be copied now without problems :)

and to print out the contents of the History folder, u can use this tool >> http://www.snapfiles.com/get/printfolders.html

I rebooted in safemode.  However, in safemode, you
 can't access the [local settings] folder c:\documentandsettings\jat\localsettings\ which is where I see the history is located on everyone else's computer.  If I try to copy the History folder just under c:\documentsandsettings\jat (jat being the username) ... when I reboot in regular mode, I still don't see her previous history.

Am I trying to copy it to the wrong location?

JAT has been gone since 8/23/04.  I changed the system clock to reflect it is 8/22/04 (the date I copied her history), but that doesnt seem to make a difference.

I also downloaded a copy of that software recommended and while it did take the History.IE5 folder and it's subfolders and convert them to text, they don't show any of the websites she visited - only stuff like this:

MSHIST012004061520040616     DIR   8/23/2004      10:44:39 AM
MSHIST012004080920040816     DIR   8/23/2004      10:44:39 AM
MSHIST012004081620040817     DIR   8/23/2004      10:44:39 AM


or
CAXEGDDH         (0 bytes)       8/19/2004      11:46:35 AM
CAXVJB2H    0.0 KB (0 bytes)   8/20/2004      1:47:34 PM
CAY2U38I     0.0 KB (0 bytes)   8/20/2004      10:16:43 AM
CAY3OHQZ   0.0 KB (0 bytes)   8/20/2004      12:29:04 PM

Any further help is greatly appreciated....

>> However, in safemode, you can't access the [local settings] folder c:\documentandsettings\jat\localsettings\

Why,,,, why cant u access the Local Settings folder,,,,, u shud be able to access it, everyone can access it via safemode :)
Have u turned on the Show Hidden Files feauture from Tools>Folder Options>View, in safemode to see the Local Settings folder :)

and when u open History folder, u can see the subfolders there as, 1 Week Ago, Today, Yesterday etc etc
open any of these folders, and now u can see all the websites, now print with that tool, it shud convert these websites(contents of this folder) to text !!

Okay - here's what I've done: (and yes, I discovered I didn't have view hidden files on).  (Haste makes waste!)

I created a new user account called "JAT" on my own machine (for convenience sake).

I rebooted in safemode under my own Admin username "DLB".

I went to the network directory where I copied various files from JAT's workstation the day before she did a mass deletion which included the following:

C:\documentsandsettings\jat\Local Settings\Temp
and
c:\documents and settings\jat\local settings\temporary internet files folders

I also have 2 folders:

History\History.IE5  
and
Favorites

Since I created a new JAT user account on my personal workstation, I was able to put those above-referenced folders in the corresponding directories

c:\documentsandsettings\jat\localsettings\ .....

I logged out and back in under username JAT
and went to the internet and clicked on "History".

It only gives me a history for TODAY.

Why is it not reading what I copied?
Did I not copy enough from her computer (before she did her mass deletion) to be able to restore this stuff?  I simply overwrote the existing files with these old files -- so I presume I'm restoring them to the proper location.

Help?

Also,

If I just click on the "History" folder, there's a subfolder "History.IE5".  Within that folder are various subfolders:

MSHisto012004061520040816
MSHisto012004081620040817
MSHisto012004081620040818
MSHisto012004081620040819
MSHisto012004081620040820
MSHisto012004081620040821

within each of those folders is only one file:
index.dat each.

The only thing that snap program gives me is a printout that it's an index file and the date.  No "website" information.

Is website content stored in "Offline Content?" I didn't copy her "Offline content folder" before she deleted it.

Also, I don't see "Today, Last Week, 2 Weeks ago." when I go to look at it, just what I described above.

i can understand everything u are doing, and u are doing in a very right way, nothing is wrong anywhere :)
but just tell me one thing,,, when u created the JAT account,,,, did u logged in with this user for once before copying the data to its profile folder ??

Good question -

No I don't believe I did log in using JAT's login after I created her account.  I specifically did not want I.E. to create a new history before I had a chance to copy the "old" history to her "clean" account.

that's the mistake,,,, login with it first and let the system to create all of its new folders,,,,, then restart to login in safmeode with ur admin account, and now "Replace" those newly created folders with the ones u copied from her account !!

the ideal idea of copying an old data to a new user is by "Replacing" the new data, coz these folders get created when the new user login for the first time...... and if u put something already there before loggin in, and then login, the copied folder get replaced by the newly created folders and thus u will get all of them as freshly created..... understand now ?? :)

Okay,

I deleted the JAT account entirely and started over.

I created a new JAT account & mapped network drives (so I could copy the History file I have on the server).

I then logged into the internet - to create a new history for today (August 22, 2004).

I rebooted in safe mode.

I logged into JAT's account (as it had administrator rights).

Went to Documents & Settings\JAT\Local Settings\  and saw a "History" folder.

***I clicked on that history folder and yes, it shows me what history I had for TODAY.***

I then backed out of that History folder, and pasted the original History folder to that directory.  It of course advised that a folder already existed and did I want to replace it and it's contents.  I selected, "Yes."

I then clicked on the folder and instead of opening to show me the history for Today (as it had moments earlier)... it shows me a subfolder "History.IE5".  (Nothing else).

When I click on "History.IE5" it shows me subfolders as follows:

MSHist012004061520040816
MSHist012004061520040817
and so on.

When I copied her History Folder originally, there apparently was a subfolder called History.IE5.

I never thought anything of it, but it is apparently the reason I cannot simply click on the history folder and see Today, Last Week, 2 Weeks ago.

What gives?!

I even tried moving those subfolders up a level so that the History.IE5 folder wasn't the reason I couldn't see "Today, Last Week, 2 Weeks ago".

Any ideas?

Should I have copied more than just her "History" folder? in order to restore it?

Although I can't figure out why you can view your internet history, and I can't, I did download that index-dat viewer and at long last! it shows me what websites she was on the last week of her employment!  

I have a curious question tho - the viewer lists the date and TIME she accessed sites, which is inaccurate.  It shows her accessing the sites sometimes at 7:00 - 8:00 or 11:00 p.m.  even Midnight.  Clearly the time is wrong as I matched when she clocked in and out.  She doesn't have access to the building after hours, so,  I'm disappointed the time of day is wrong.  I can't rely on the "time of day" she was browsing the internet, just the fact she used her internet for everything BUT work.

Any ideas why the time might be wrong??  Her computer clock was not wrong, and some of the times of day coincide with her work schedule.  Just a curious thought.

Thank you for your assistance, I would award more points if it let me.   Thanks again!

hmmmmm the viewer gets the information which is stored in the index.dat....
so its quite impossible to tell if viewer is telling wrong or index.dat has stored the time and date wrongly :-?

can u try this,,,,, download and use this tool >> http://www.spychecker.com/program/indexdatsuite.html
Does it report the time and data as reported by Index.dat viewer or different from it ??