Kurupt
11-28-2003, 11:44 AM
All rights of this go to -geffers @ pctechtalk
"Just to freak those of you out that don't already know about this. There are databases on your system that can be used against you. These Databases (index.dat files) contain every URL you have visited and also contain anything you have searched for in a search engine!
There are folders on your computer that Microsoft has tried hard to keep secret. Within these folders you will find two major things: Microsoft Internet Explorer has not been clearing your browsing history after you have instructed it to do so, and -geffers @ pctechtalk
Microsoft's Outlook Express has not been deleting your e-mail correspondence after you've erased them from your Deleted Items bin. (This also includes all incoming and outgoing file attachments.) And believe me, that's not even the half of it.
When I say these files are hidden well, I really mean it. If you don't have any knowledge of DOS then don't plan on finding these files on your own. I say this because these files/folders won't be displayed in Windows Explorer at all -- only DOS. (Even after you have enabled Windows Explorer to "show all files.") And to top it off, the only way to find them in DOS is if you knew the exact location of them. Basically, what I'm saying is if you didn't know the files existed then the chances of you running across them is slim to slimmer.
It's interesting to note that Microsoft does not explain this behavior adequately at all. Just try searching on microsoft.com.
Now, enabling Windows Explorer to "show all files" does not show the files in mention. No. DOS does not list the files after receiving a proper directory listing from root. And yes. Microsoft intentionally disabled the "Find" utility from searching through one of the folders.
Oh, but that's not all.
Just from one of these files I would be able to tell you which web sites you previously visited, what types of things you search for in search engines, and probably gather your ethnicity, religion, and sexual preference. Needless to say one can build quite a profile on you from these files. It has the potential to expose and humiliate -- putting your marriage, friendship, and corporation at risk. Here's one good example of the forensic capabilities.
"I've been reading your article as I have a problem with an employee of mine. He has been using the work's PC for the internet and using it to chat and look at :banana::banana::banana::banana: sites. He was then deleting the cookies and history in order to cover his tracks. A friend of mine pointed me in the direction of this site and your article. I have found it to be incredibly useful . . ."
-- Concerned Boss, 8/24/01
Index.dat are file hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. Not only that but all of the email that has been sent or received through Outlook or Outlook Express is also being logged. The file names and locations depend on what version of Internet Explorer you have. If you are running IE version 4.0 or above, the file name is "index.dat". Microsoft has not supplied an adequate explanation as to what these files are for or why they have been hidden so well.
According to Microsoft, these files are used to cache visited Web sites to help speed up the loading of Web pages in Internet Explorer. Obviously this cannot be the case because when you clear the Temporary Internet Files the "index.dat" files remain behind and continue to grow. If you delete or clear the Temporary Internet Files, there is absolutely no need to index the URL cache because those files no longer exist.
On a Windows 9x computer these files are located in the following locations:
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
In Windows 2000 and Windows XP there are several "index.dat" files in these locations: Note that the MSHist numbers are different on different systems. I use autocomplete in my dos box so I type cd MSH then hit the tab button so it completes the directory name for me.
\Documents and Settings\<Username>\Cookies\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\MSHist012001123120020 101\index.dat
\Documents and Settings\<Username>\Local
Settings\History\History.IE5\MSHist012002010720020 114\index.dat
\Documents and Settings\<Username>\Local
Internet Files\Content.IE5\index.dat
These files can be very hard to find. If you are in Windows, even with "Show hidden files and folders" enabled, these files are not visible and cannot be found if you do a search for these files. The reason that these files are so invisible is that they are not just hidden, they have been designated as "system" files. System files and folders are treated differently in DOS and Windows and are effectively cloaked from casual searches.
Index.dat files are always being used by windows system, you can not delete them manually, and even you clear Temporary Internet Files on Internet Option of Internet Explorer, it will not delete them.
Now clean them up. I know I did!"
-geffers @ pctechtalk
"Just to freak those of you out that don't already know about this. There are databases on your system that can be used against you. These Databases (index.dat files) contain every URL you have visited and also contain anything you have searched for in a search engine!
There are folders on your computer that Microsoft has tried hard to keep secret. Within these folders you will find two major things: Microsoft Internet Explorer has not been clearing your browsing history after you have instructed it to do so, and -geffers @ pctechtalk
Microsoft's Outlook Express has not been deleting your e-mail correspondence after you've erased them from your Deleted Items bin. (This also includes all incoming and outgoing file attachments.) And believe me, that's not even the half of it.
When I say these files are hidden well, I really mean it. If you don't have any knowledge of DOS then don't plan on finding these files on your own. I say this because these files/folders won't be displayed in Windows Explorer at all -- only DOS. (Even after you have enabled Windows Explorer to "show all files.") And to top it off, the only way to find them in DOS is if you knew the exact location of them. Basically, what I'm saying is if you didn't know the files existed then the chances of you running across them is slim to slimmer.
It's interesting to note that Microsoft does not explain this behavior adequately at all. Just try searching on microsoft.com.
Now, enabling Windows Explorer to "show all files" does not show the files in mention. No. DOS does not list the files after receiving a proper directory listing from root. And yes. Microsoft intentionally disabled the "Find" utility from searching through one of the folders.
Oh, but that's not all.
Just from one of these files I would be able to tell you which web sites you previously visited, what types of things you search for in search engines, and probably gather your ethnicity, religion, and sexual preference. Needless to say one can build quite a profile on you from these files. It has the potential to expose and humiliate -- putting your marriage, friendship, and corporation at risk. Here's one good example of the forensic capabilities.
"I've been reading your article as I have a problem with an employee of mine. He has been using the work's PC for the internet and using it to chat and look at :banana::banana::banana::banana: sites. He was then deleting the cookies and history in order to cover his tracks. A friend of mine pointed me in the direction of this site and your article. I have found it to be incredibly useful . . ."
-- Concerned Boss, 8/24/01
Index.dat are file hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. Not only that but all of the email that has been sent or received through Outlook or Outlook Express is also being logged. The file names and locations depend on what version of Internet Explorer you have. If you are running IE version 4.0 or above, the file name is "index.dat". Microsoft has not supplied an adequate explanation as to what these files are for or why they have been hidden so well.
According to Microsoft, these files are used to cache visited Web sites to help speed up the loading of Web pages in Internet Explorer. Obviously this cannot be the case because when you clear the Temporary Internet Files the "index.dat" files remain behind and continue to grow. If you delete or clear the Temporary Internet Files, there is absolutely no need to index the URL cache because those files no longer exist.
On a Windows 9x computer these files are located in the following locations:
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
In Windows 2000 and Windows XP there are several "index.dat" files in these locations: Note that the MSHist numbers are different on different systems. I use autocomplete in my dos box so I type cd MSH then hit the tab button so it completes the directory name for me.
\Documents and Settings\<Username>\Cookies\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\MSHist012001123120020 101\index.dat
\Documents and Settings\<Username>\Local
Settings\History\History.IE5\MSHist012002010720020 114\index.dat
\Documents and Settings\<Username>\Local
Internet Files\Content.IE5\index.dat
These files can be very hard to find. If you are in Windows, even with "Show hidden files and folders" enabled, these files are not visible and cannot be found if you do a search for these files. The reason that these files are so invisible is that they are not just hidden, they have been designated as "system" files. System files and folders are treated differently in DOS and Windows and are effectively cloaked from casual searches.
Index.dat files are always being used by windows system, you can not delete them manually, and even you clear Temporary Internet Files on Internet Option of Internet Explorer, it will not delete them.
Now clean them up. I know I did!"
-geffers @ pctechtalk