Knowledgebase:
Viewing Internet Explorer Browser Data
Posted by Jack H. Ward on 07 February 2018 03:20 AM

Internet Explorer Browser Data allows the user to view the contents of the History, Cookies and Temporary Internet Files list.

 The Cookies and History data created by Internet Explorer is displayed in a grid with the following columns:

  • Type: This field contains the type of the record. Four types of records are available:
    • URL (URL that was actually requested)
    • REDR (Internet Explorer Browser was redirected to another site)
    • HASH (Hash record precedes the URL record. This hash is used by Internet Explore to speed up its traversal/sorting of all the URL records
    • LEAK: (A LEAK record is created when the machine attempts to delete records from the history file while a corresponding Temporary Internet File is held open and cannot be deleted)
  • URL: This field displays the global address of the page on the World Wide Web.
  • Title: This field contains the title of the document. It defines the title in the Internet Explorer Browser toolbar, provides a title for the page when it is added to favorites, and displays a title for the page in search-engine results 
  • User: 
    • Cookies: This field displays the name of the user, for whom a cookie was created.
    • History: This field displays the name of the user who visited a page.
  • Hit Count: This field shows the number of requests to a web server for a web page.
  • Modified Time: This field contains the date and time of last modification of a web page.
  • Access Time: This field contains the last web page access date and time.

The Temporary Internet Files data created by Internet Explorer is displayed in a grid with the following columns:

  • Type: This field contains the type of record. Four types of records are available:
    • URL (URL that was actually requested)
    • REDR (Internet Explorer Browser was redirected to another site)
    • HASH (Hash record precedes the URL record. This hash is used by Internet Explorer to speed up its traversal/sorting of all the URL records.
    • LEAK: (LEAK records are created when the machine attempts to delete records from the history file while a corresponding Temporary Internet File (TIF) is held open and cannot be deleted.
  • URL: This field displays the global address of documents and other resources on the World Wide Web.
  • Header: This field contains a main part of Internet protocol (set of rules for formatting certain types of data and instructions) that can be sent with a request from the Internet Explorer
  • Hit Count: This field shows the number of requests to a web server for a web page.
  • File name: This field contains a temporary Internet file name in the file system of a computer.
  • Directory: This field contains the name of the directory where a temporary Internet file is stored.
  • File Size: This field contains a length of a temporary Internet file in bytes.
  • Modified Time: This field contains the date and time of last modification of a web page.
  • Access Time: This field contains the last web page access date and time.

Viewing Internet Explorer Temporary Internet Files

Information about temporary internet files consists of two parts:

  • The index.dat file: This file contains information on the files and can be added as evidence to the case.
  • Folders with files: In these files, the temporary downloaded files are stored. These folders can be found in the same location as the index.dat file. If these folders are placed in the same folder as the index.dat file when it is added as evidence, the images from them are opened in the Thumbnails pane where they can be exported. If there are no folders with images, then no images will be displayed in the Thumbnails pane.

The index.dat file and corresponding folders with images are stored in the following locations: \Users\<user>\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat.

(0 vote(s))
Helpful
Not helpful

Comments (0)