Computer Forensics For Dummies by Volonino Linda & Anzaldua Reynaldo

Author:Volonino, Linda & Anzaldua, Reynaldo [Volonino, Linda]
Language: eng
Format: epub
Tags: Computing, Internet
ISBN: 9780470434789
Publisher: John Wiley and Sons
Published: 2008-12-03T05:00:00+00:00

Figure 9-10: Virtual memory control settings in Microsoft Windows.

Internet history

Internet Explorer has the ability to keep track of where the Web browser has visited. The user has quite a bit of control and can adjust the number of days the browser hangs onto the list of Web sites (the Internet history). Most users think that deleting the history deletes the files forever! The part most users cannot control is the index.dat file. Internet Explorer uses the index.dat file to create a database of Web sites visited, cookies, and assorted other details pertaining to the use of the Web browser.

You can extract data from the index.dat file and re-create the tracks of where you have been, often going back to the first day you ever surfed the Internet on that particular computer. Other Web browsers, such as Mozilla and Opera, also have the ability to keep these types of files.

Because most Web browsers keep histories, computer forensic software is designed to open these types of files to extract the data quite easily. In the case of EnCase and FTK, the process is automated to the point where the software not only looks for active database files, but also deleted files in unallocated space that contain web surfing histories. Figure 9-11 shows multiple index.dat files on one computer detailing the history of Internet Web browser use.

Figure 9-11: List of index.dat files found on a single computer.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.