Find visited urls and cookies of every user in index.dat

Martin Brinkmann
Oct 14, 2006
Updated • May 15, 2013
Internet Explorer
|
11

When you delete the visited urls and the cache in Internet Explorer after disconnecting your computer from the internet you are safe, right? Many users think that it is impossible to find out which websites they have visited when they delete the cache and the history. This is not true..

There is a file on the system that collects information about websites and cookies. It is called index.dat and is populated by default on Windows operating systems. The information are retained even if you decided to delete the browser cache and history.Microsoft surely has a good explanation for this, right? They say it is to speed up Internet Explorer but this sounds somewhat fishy, why would you need to keep a copy of cookies for instance if you have deleted them?

To find index.dat on your computer you need to do the following.

  1. Open any folder, click on Tools then Folder Options.
  2. Select View from the tab and uncheck "hide protected operating system files" and make sure "Show hidden files and folders is enabled".
  3. Now search for index.dat and Windows will display all the files in the search results.

Note that this is handled different in newer versions of Windows. When in Windows Explorer, click on Organize and then on Folder and Search options. Follow the instructions posted above from this point onwards.

hide protected operating system files

You can't just open the program in a text editor though. You need a specialized program to view the contents of index.dat files, and Pasco by Keith Jones is one of those applications. It is a freeware tool that you run from the command line. Download and unpack it to your system. You then need to open a command prompt in the following way:

  1. Use Windows-R to open a new run box.
  2. Type cmd and hit enter.

Change to the pasco directory using the CD command and enter the following command when you are there:

pasco index.dat > urls.txt

Pasco creates a text file with all urls that are saved in the index.dat file. You can then view the with every text editor available. The same works with the index.dat that holds the cookies of course.

pasco index.dat

Note that you need to either copy the index.data file into the same directory, or add the full path to the index.data file that you want to analyze to the command.

Ever wanted to know what your kids, husband, wife, friends, co-workers do when they are alone ? Use the index.dat file to find out.

How to remove the index.dat file:

The index.dat file is protected in windows and you will have a hard time deleting it from within.

These data files are used by Internet Explorer and Windows Explorer. You cannot delete a file that is in use by a running program. If you feel you need to delete the file, you will have to shutdown all instances of Explorer and IE. This includes applications that may host the Webbrowser control: Outlook, Messenger, IE, Product Studio, Visual Studio, Help, Windows Media Player, etc. Your best bet is just close everything. When you are left with a desktop and a start menu, you will still need to shutdown Explorer. To cleanly shutdown Explorer: Start->Shutdown->CTRL+ALT+SHIFT+Click 'Cancel' (for more info, see this post). You can use Task Manager (CTRL+SHIFT+ESC, File->Run...) at this point to open a command window. You should be able to go delete the index.dat. I have only tried this on XPSP2, but it should work anywhere.

thanks to Jeff for this information

Another way would be to boot either into safemode or dos to kill the file. Check out this index.dat program if you prefer a program to check and delete index.dat information.

Advertisement

Previous Post: «
Next Post: «

Comments

  1. Flash said on August 29, 2011 at 3:50 pm
    Reply

    Microsoft is so desperate to keep you away from Index.dat files that they keeps moving the goalposts via service packs and new versions of windows so what worked yesterday, won’t work today.

    Some of the ‘Special Hidden’ folders won’t show even when you use a registry hack and killing processes ‘Explorer’ and ‘IExplorer’ before you try to delete them still won’t unlock the files on Windows 7 X 64 (Build 7600) and running batch files without exposing account names and passwords cannot remove these index.dat files at reboot due to the wrong windows permissions.

    One method that might still works is to boot-up in safe mode and then assign yourself administrator rights and then see if you can find the files to delete them

    The method I now use is to create a batch file to rename the subfolder below the folder containing the index.bat files and to then only copy the folders back to the original location that don’t contain these Spyware files but the resultant batch files needs to be run from a separate windows account that has full administrator permissions.

    Click my name to learn more and to view the source code to do the job.

  2. David said on February 11, 2009 at 10:52 pm
    Reply

    what about Macintosh Computer and Firefox browser. Is there an equivalent of the index. dat file? Can you retrieve cleared URLs?

  3. John said on April 15, 2008 at 3:44 pm
    Reply

    On the last statement:

    ‘The new Internet Explorer 7 apparently fixes this issue.’

    Beware! Index.dat files are now inactive and not generated with Explorer 7. Big Brother just came up with something better and more clever, and of course, he is not giving up. It will only be a matter of time until the new system is discovered, made public, and (hopefully) with solutions for deletion.

  4. Filthy Jesus said on October 14, 2006 at 8:07 pm
    Reply

    You cold always jsut use CCleaner.

    http://ccleaner.com

  5. NAIF said on October 14, 2006 at 7:41 pm
    Reply

    Thanks a lot > :)

  6. Martin said on October 14, 2006 at 5:21 pm
    Reply

    my link is working ;)

  7. mrA said on October 14, 2006 at 5:14 pm
    Reply
  8. Oliver Alexander said on October 14, 2006 at 12:36 pm
    Reply

    Whacking a link to batchfile with the content

    “”
    del /f /q “C:\Documents …\…\index.dat”
    “””
    into the StartUp Startmenu group. That should do the job. If not the link is executed to late, then try putting a reference to the batch file in to the Registry “Run” section, where it seems to be reliably executed before Explorer.exe etc. start. Specify in the shortcut to the batchfile a “minimized” execution for speed.

    Thus privacy is restored whenever the system re-starts.

    A modification on the theme is, eg., to replace the cookies dat file with an appropriate one

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.