• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1810
  • Last Modified:

Need to Restore Internet History Folder!

I copied the Internet History folder of an employee who was abusing her internet privileges   The next business day, she deleted her internet history, including her offline content and cookies.  I tried to "re-copy" the History folder but it won't let me.  I have the History Folder, how can I view the websites she visited?  I know for a fact she visited over 45 websites during one business day!  We have an upcoming hearing regarding this employee and I want to be able to print out this information.   Whomever can help me be able to restore this information to be able to print it out, is worthy of the 500 points I'm offering!
  • 8
  • 6
1 Solution
Hello anaed =)

>> I tried to "re-copy" the History folder but it won't let me

Boot ur system in safemode, and login with the Administrator account
now try to copy the history folder to her account or to another account, it shud be copied now without problems :)
and to print out the contents of the History folder, u can use this tool >> http://www.snapfiles.com/get/printfolders.html
anaedAuthor Commented:
I rebooted in safemode.  However, in safemode, you
 can't access the [local settings] folder c:\documentandsettings\jat\localsettings\ which is where I see the history is located on everyone else's computer.  If I try to copy the History folder just under c:\documentsandsettings\jat (jat being the username) ... when I reboot in regular mode, I still don't see her previous history.

Am I trying to copy it to the wrong location?

JAT has been gone since 8/23/04.  I changed the system clock to reflect it is 8/22/04 (the date I copied her history), but that doesnt seem to make a difference.

I also downloaded a copy of that software recommended and while it did take the History.IE5 folder and it's subfolders and convert them to text, they don't show any of the websites she visited - only stuff like this:

MSHIST012004061520040616     DIR   8/23/2004      10:44:39 AM
MSHIST012004080920040816     DIR   8/23/2004      10:44:39 AM
MSHIST012004081620040817     DIR   8/23/2004      10:44:39 AM

CAXEGDDH         (0 bytes)       8/19/2004      11:46:35 AM
CAXVJB2H    0.0 KB (0 bytes)   8/20/2004      1:47:34 PM
CAY2U38I     0.0 KB (0 bytes)   8/20/2004      10:16:43 AM
CAY3OHQZ   0.0 KB (0 bytes)   8/20/2004      12:29:04 PM

Any further help is greatly appreciated....
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

>> However, in safemode, you can't access the [local settings] folder c:\documentandsettings\jat\localsettings\

Why,,,, why cant u access the Local Settings folder,,,,, u shud be able to access it, everyone can access it via safemode :)
Have u turned on the Show Hidden Files feauture from Tools>Folder Options>View, in safemode to see the Local Settings folder :)
and when u open History folder, u can see the subfolders there as, 1 Week Ago, Today, Yesterday etc etc
open any of these folders, and now u can see all the websites, now print with that tool, it shud convert these websites(contents of this folder) to text !!
anaedAuthor Commented:
Okay - here's what I've done: (and yes, I discovered I didn't have view hidden files on).  (Haste makes waste!)

I created a new user account called "JAT" on my own machine (for convenience sake).

I rebooted in safemode under my own Admin username "DLB".

I went to the network directory where I copied various files from JAT's workstation the day before she did a mass deletion which included the following:

C:\documentsandsettings\jat\Local Settings\Temp
c:\documents and settings\jat\local settings\temporary internet files folders

I also have 2 folders:


Since I created a new JAT user account on my personal workstation, I was able to put those above-referenced folders in the corresponding directories

c:\documentsandsettings\jat\localsettings\ .....

I logged out and back in under username JAT
and went to the internet and clicked on "History".

It only gives me a history for TODAY.

Why is it not reading what I copied?
Did I not copy enough from her computer (before she did her mass deletion) to be able to restore this stuff?  I simply overwrote the existing files with these old files -- so I presume I'm restoring them to the proper location.

anaedAuthor Commented:

If I just click on the "History" folder, there's a subfolder "History.IE5".  Within that folder are various subfolders:


within each of those folders is only one file:
index.dat each.

The only thing that snap program gives me is a printout that it's an index file and the date.  No "website" information.

Is website content stored in "Offline Content?" I didn't copy her "Offline content folder" before she deleted it.

Also, I don't see "Today, Last Week, 2 Weeks ago." when I go to look at it, just what I described above.
i can understand everything u are doing, and u are doing in a very right way, nothing is wrong anywhere :)
but just tell me one thing,,, when u created the JAT account,,,, did u logged in with this user for once before copying the data to its profile folder ??
anaedAuthor Commented:
Good question -

No I don't believe I did log in using JAT's login after I created her account.  I specifically did not want I.E. to create a new history before I had a chance to copy the "old" history to her "clean" account.

that's the mistake,,,, login with it first and let the system to create all of its new folders,,,,, then restart to login in safmeode with ur admin account, and now "Replace" those newly created folders with the ones u copied from her account !!

the ideal idea of copying an old data to a new user is by "Replacing" the new data, coz these folders get created when the new user login for the first time...... and if u put something already there before loggin in, and then login, the copied folder get replaced by the newly created folders and thus u will get all of them as freshly created..... understand now ?? :)
anaedAuthor Commented:

I deleted the JAT account entirely and started over.

I created a new JAT account & mapped network drives (so I could copy the History file I have on the server).

I then logged into the internet - to create a new history for today (August 22, 2004).

I rebooted in safe mode.

I logged into JAT's account (as it had administrator rights).

Went to Documents & Settings\JAT\Local Settings\  and saw a "History" folder.

***I clicked on that history folder and yes, it shows me what history I had for TODAY.***

I then backed out of that History folder, and pasted the original History folder to that directory.  It of course advised that a folder already existed and did I want to replace it and it's contents.  I selected, "Yes."

I then clicked on the folder and instead of opening to show me the history for Today (as it had moments earlier)... it shows me a subfolder "History.IE5".  (Nothing else).

When I click on "History.IE5" it shows me subfolders as follows:

and so on.

When I copied her History Folder originally, there apparently was a subfolder called History.IE5.

I never thought anything of it, but it is apparently the reason I cannot simply click on the history folder and see Today, Last Week, 2 Weeks ago.

What gives?!

I even tried moving those subfolders up a level so that the History.IE5 folder wasn't the reason I couldn't see "Today, Last Week, 2 Weeks ago".

Any ideas?

Should I have copied more than just her "History" folder? in order to restore it?
dont know what's happening with u coz i always do it and it always works =\

say i want to format my C: drive which has my profile folder with the history folder in it,,,, i have naother D: partition for backup !!
So to backup the history folder, i copy it to D: drive, now when i open it i can see the ContentIE folder and not Today Yesterday etc etc,,,,, ok no problem !!
i go ahead and format and reinstall XP, now i have a new user with a new histroy folder, which has just TODAY in it !!
now i boot into safemode, and login as Administrator(not with my user), then i goto D: drive, copy the Histroy folder, comes back to my profile in C: and paste here it, it says do u want to replace, i say OK, and it replaces it !!
then i reboot back in normal mode and connects to internet, click the History tab and i have all my old history websites there,,,, and now when i go and open history from C: drive in my profile, it has not listed Today or anything, but all the websites itself, and as i keep on visiting the extra websites, it keeps adding the new ones per today, yesterday, etc etc and deleting the old ones !!
and i just cannot understand why this is not happening with u :-?

ok let's take the other route..... u have those subfolders with those index.dat files, right ??
then download this tool called Index.dat Viewer >> http://www.exits.ro/index-dat-viewer.html
Open those subfolders' index.dat files in it and check if u can view the websites thru it or not ?? :)
anaedAuthor Commented:
Although I can't figure out why you can view your internet history, and I can't, I did download that index-dat viewer and at long last! it shows me what websites she was on the last week of her employment!  

I have a curious question tho - the viewer lists the date and TIME she accessed sites, which is inaccurate.  It shows her accessing the sites sometimes at 7:00 - 8:00 or 11:00 p.m.  even Midnight.  Clearly the time is wrong as I matched when she clocked in and out.  She doesn't have access to the building after hours, so,  I'm disappointed the time of day is wrong.  I can't rely on the "time of day" she was browsing the internet, just the fact she used her internet for everything BUT work.

Any ideas why the time might be wrong??  Her computer clock was not wrong, and some of the times of day coincide with her work schedule.  Just a curious thought.

Thank you for your assistance, I would award more points if it let me.   Thanks again!
hmmmmm the viewer gets the information which is stored in the index.dat....
so its quite impossible to tell if viewer is telling wrong or index.dat has stored the time and date wrongly :-?

can u try this,,,,, download and use this tool >> http://www.spychecker.com/program/indexdatsuite.html
Does it report the time and data as reported by Index.dat viewer or different from it ??
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Microsoft Exchange Server

The MCTS: Microsoft Exchange Server 2010 certification validates your skills in supporting the maintenance and administration of the Exchange servers in an enterprise environment. Learn everything you need to know with this course.

  • 8
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now