Need to Restore Internet History Folder!

Posted on 2004-10-18
Last Modified: 2012-06-27
I copied the Internet History folder of an employee who was abusing her internet privileges   The next business day, she deleted her internet history, including her offline content and cookies.  I tried to "re-copy" the History folder but it won't let me.  I have the History Folder, how can I view the websites she visited?  I know for a fact she visited over 45 websites during one business day!  We have an upcoming hearing regarding this employee and I want to be able to print out this information.   Whomever can help me be able to restore this information to be able to print it out, is worthy of the 500 points I'm offering!
Question by:anaed
  • 8
  • 6
LVL 65

Expert Comment

ID: 12341354
Hello anaed =)

>> I tried to "re-copy" the History folder but it won't let me

Boot ur system in safemode, and login with the Administrator account
now try to copy the history folder to her account or to another account, it shud be copied now without problems :)
LVL 65

Expert Comment

ID: 12341377
and to print out the contents of the History folder, u can use this tool >>

Author Comment

ID: 12342186
I rebooted in safemode.  However, in safemode, you
 can't access the [local settings] folder c:\documentandsettings\jat\localsettings\ which is where I see the history is located on everyone else's computer.  If I try to copy the History folder just under c:\documentsandsettings\jat (jat being the username) ... when I reboot in regular mode, I still don't see her previous history.

Am I trying to copy it to the wrong location?

JAT has been gone since 8/23/04.  I changed the system clock to reflect it is 8/22/04 (the date I copied her history), but that doesnt seem to make a difference.

I also downloaded a copy of that software recommended and while it did take the History.IE5 folder and it's subfolders and convert them to text, they don't show any of the websites she visited - only stuff like this:

MSHIST012004061520040616     DIR   8/23/2004      10:44:39 AM
MSHIST012004080920040816     DIR   8/23/2004      10:44:39 AM
MSHIST012004081620040817     DIR   8/23/2004      10:44:39 AM

CAXEGDDH         (0 bytes)       8/19/2004      11:46:35 AM
CAXVJB2H    0.0 KB (0 bytes)   8/20/2004      1:47:34 PM
CAY2U38I     0.0 KB (0 bytes)   8/20/2004      10:16:43 AM
CAY3OHQZ   0.0 KB (0 bytes)   8/20/2004      12:29:04 PM

Any further help is greatly appreciated....
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 65

Expert Comment

ID: 12342649
>> However, in safemode, you can't access the [local settings] folder c:\documentandsettings\jat\localsettings\

Why,,,, why cant u access the Local Settings folder,,,,, u shud be able to access it, everyone can access it via safemode :)
Have u turned on the Show Hidden Files feauture from Tools>Folder Options>View, in safemode to see the Local Settings folder :)
LVL 65

Expert Comment

ID: 12342671
and when u open History folder, u can see the subfolders there as, 1 Week Ago, Today, Yesterday etc etc
open any of these folders, and now u can see all the websites, now print with that tool, it shud convert these websites(contents of this folder) to text !!

Author Comment

ID: 12342736
Okay - here's what I've done: (and yes, I discovered I didn't have view hidden files on).  (Haste makes waste!)

I created a new user account called "JAT" on my own machine (for convenience sake).

I rebooted in safemode under my own Admin username "DLB".

I went to the network directory where I copied various files from JAT's workstation the day before she did a mass deletion which included the following:

C:\documentsandsettings\jat\Local Settings\Temp
c:\documents and settings\jat\local settings\temporary internet files folders

I also have 2 folders:


Since I created a new JAT user account on my personal workstation, I was able to put those above-referenced folders in the corresponding directories

c:\documentsandsettings\jat\localsettings\ .....

I logged out and back in under username JAT
and went to the internet and clicked on "History".

It only gives me a history for TODAY.

Why is it not reading what I copied?
Did I not copy enough from her computer (before she did her mass deletion) to be able to restore this stuff?  I simply overwrote the existing files with these old files -- so I presume I'm restoring them to the proper location.


Author Comment

ID: 12342818

If I just click on the "History" folder, there's a subfolder "History.IE5".  Within that folder are various subfolders:


within each of those folders is only one file:
index.dat each.

The only thing that snap program gives me is a printout that it's an index file and the date.  No "website" information.

Is website content stored in "Offline Content?" I didn't copy her "Offline content folder" before she deleted it.

Also, I don't see "Today, Last Week, 2 Weeks ago." when I go to look at it, just what I described above.
LVL 65

Expert Comment

ID: 12342847
i can understand everything u are doing, and u are doing in a very right way, nothing is wrong anywhere :)
but just tell me one thing,,, when u created the JAT account,,,, did u logged in with this user for once before copying the data to its profile folder ??

Author Comment

ID: 12343362
Good question -

No I don't believe I did log in using JAT's login after I created her account.  I specifically did not want I.E. to create a new history before I had a chance to copy the "old" history to her "clean" account.

LVL 65

Expert Comment

ID: 12343429
that's the mistake,,,, login with it first and let the system to create all of its new folders,,,,, then restart to login in safmeode with ur admin account, and now "Replace" those newly created folders with the ones u copied from her account !!

the ideal idea of copying an old data to a new user is by "Replacing" the new data, coz these folders get created when the new user login for the first time...... and if u put something already there before loggin in, and then login, the copied folder get replaced by the newly created folders and thus u will get all of them as freshly created..... understand now ?? :)

Author Comment

ID: 12353626

I deleted the JAT account entirely and started over.

I created a new JAT account & mapped network drives (so I could copy the History file I have on the server).

I then logged into the internet - to create a new history for today (August 22, 2004).

I rebooted in safe mode.

I logged into JAT's account (as it had administrator rights).

Went to Documents & Settings\JAT\Local Settings\  and saw a "History" folder.

***I clicked on that history folder and yes, it shows me what history I had for TODAY.***

I then backed out of that History folder, and pasted the original History folder to that directory.  It of course advised that a folder already existed and did I want to replace it and it's contents.  I selected, "Yes."

I then clicked on the folder and instead of opening to show me the history for Today (as it had moments earlier)... it shows me a subfolder "History.IE5".  (Nothing else).

When I click on "History.IE5" it shows me subfolders as follows:

and so on.

When I copied her History Folder originally, there apparently was a subfolder called History.IE5.

I never thought anything of it, but it is apparently the reason I cannot simply click on the history folder and see Today, Last Week, 2 Weeks ago.

What gives?!

I even tried moving those subfolders up a level so that the History.IE5 folder wasn't the reason I couldn't see "Today, Last Week, 2 Weeks ago".

Any ideas?

Should I have copied more than just her "History" folder? in order to restore it?
LVL 65

Accepted Solution

SheharyaarSaahil earned 500 total points
ID: 12353694
dont know what's happening with u coz i always do it and it always works =\

say i want to format my C: drive which has my profile folder with the history folder in it,,,, i have naother D: partition for backup !!
So to backup the history folder, i copy it to D: drive, now when i open it i can see the ContentIE folder and not Today Yesterday etc etc,,,,, ok no problem !!
i go ahead and format and reinstall XP, now i have a new user with a new histroy folder, which has just TODAY in it !!
now i boot into safemode, and login as Administrator(not with my user), then i goto D: drive, copy the Histroy folder, comes back to my profile in C: and paste here it, it says do u want to replace, i say OK, and it replaces it !!
then i reboot back in normal mode and connects to internet, click the History tab and i have all my old history websites there,,,, and now when i go and open history from C: drive in my profile, it has not listed Today or anything, but all the websites itself, and as i keep on visiting the extra websites, it keeps adding the new ones per today, yesterday, etc etc and deleting the old ones !!
and i just cannot understand why this is not happening with u :-?

ok let's take the other route..... u have those subfolders with those index.dat files, right ??
then download this tool called Index.dat Viewer >>
Open those subfolders' index.dat files in it and check if u can view the websites thru it or not ?? :)

Author Comment

ID: 12362932
Although I can't figure out why you can view your internet history, and I can't, I did download that index-dat viewer and at long last! it shows me what websites she was on the last week of her employment!  

I have a curious question tho - the viewer lists the date and TIME she accessed sites, which is inaccurate.  It shows her accessing the sites sometimes at 7:00 - 8:00 or 11:00 p.m.  even Midnight.  Clearly the time is wrong as I matched when she clocked in and out.  She doesn't have access to the building after hours, so,  I'm disappointed the time of day is wrong.  I can't rely on the "time of day" she was browsing the internet, just the fact she used her internet for everything BUT work.

Any ideas why the time might be wrong??  Her computer clock was not wrong, and some of the times of day coincide with her work schedule.  Just a curious thought.

Thank you for your assistance, I would award more points if it let me.   Thanks again!
LVL 65

Expert Comment

ID: 12404532
hmmmmm the viewer gets the information which is stored in the index.dat....
so its quite impossible to tell if viewer is telling wrong or index.dat has stored the time and date wrongly :-?

can u try this,,,,, download and use this tool >>
Does it report the time and data as reported by Index.dat viewer or different from it ??

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question