Been tasked by one of our clients today to check on a few users browsing history. Client has no proxy server so little options that way.

Some users are fairly open and have left their history as is, but others have cleared their history on purpose.

System restore/checkpoint will not recover the history and so part from scouring the index.dat files, does anyone know of a better way to restore and find the cleared history ?

 

You can use a normal 'undelete' tool, especially as each URL is typically only one line so taking up a whole sector.

Post what you find

Steve

 

tbh its madness

if the client wants this sort of reporting get them to invest in a proper firewall/proxy server that can produces web usage logs or sack all the employess and re-employ Jehovah Witnesses

unless, off course, you are charging them £90 and hour to sift thru the dark recesses of their user profiles, then i would sit back and count the money

 

Storm in a teacup it seems. The MD was just looking for ways to dismiss various people and so we left her with little evidence as she can do her own dirty work. But we did charge for it