We help IT Professionals succeed at work.

webmail evidence

pma111 used Ask the Experts™
aside from the standard history sql lit db for chrome, and WebCacheV01.dat for IE history files, where else on a windows machine could give clues if a user has accessed a certain webmail service and logged in using a specific email account? I suspect either gmail or hotmail. Just want to rule out any other areas such evidence may reside apart from the obvious browser history locations.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
You might be able to dig up something you if you use a forensics tool like Redline. Otherwise, if you have something like a web proxy, which now is not looking on the machine itself.
You could also give something like IEPassView a try. Is that a long shot? Almost certainly, but it's funny the ways people will slip up sometimes without realizing it. If they saved their credentials to IE then PassView will spit them back out at you.