Find visited urls and cookies of every user in index.dat
When you delete the visited urls and the cache in Internet Explorer after disconnecting your computer from the internet you are safe, right? Many users think that it is impossible to find out which websites they have visited when they delete the cache and the history. This is not true..
There is a file on the system that collects information about websites and cookies. It is called index.dat and is populated by default on Windows operating systems. The information are retained even if you decided to delete the browser cache and history.Microsoft surely has a good explanation for this, right? They say it is to speed up Internet Explorer but this sounds somewhat fishy, why would you need to keep a copy of cookies for instance if you have deleted them?
To find index.dat on your computer you need to do the following.
- Open any folder, click on Tools then Folder Options.
- Select View from the tab and uncheck "hide protected operating system files" and make sure "Show hidden files and folders is enabled".
- Now search for index.dat and Windows will display all the files in the search results.
Note that this is handled different in newer versions of Windows. When in Windows Explorer, click on Organize and then on Folder and Search options. Follow the instructions posted above from this point onwards.
You can't just open the program in a text editor though. You need a specialized program to view the contents of index.dat files, and Pasco by Keith Jones is one of those applications. It is a freeware tool that you run from the command line. Download and unpack it to your system. You then need to open a command prompt in the following way:
- Use Windows-R to open a new run box.
- Type cmd and hit enter.
Change to the pasco directory using the CD command and enter the following command when you are there:
pasco index.dat > urls.txt
Pasco creates a text file with all urls that are saved in the index.dat file. You can then view the with every text editor available. The same works with the index.dat that holds the cookies of course.
Note that you need to either copy the index.data file into the same directory, or add the full path to the index.data file that you want to analyze to the command.
Ever wanted to know what your kids, husband, wife, friends, co-workers do when they are alone ? Use the index.dat file to find out.
How to remove the index.dat file:
The index.dat file is protected in windows and you will have a hard time deleting it from within.
These data files are used by Internet Explorer and Windows Explorer. You cannot delete a file that is in use by a running program. If you feel you need to delete the file, you will have to shutdown all instances of Explorer and IE. This includes applications that may host the Webbrowser control: Outlook, Messenger, IE, Product Studio, Visual Studio, Help, Windows Media Player, etc. Your best bet is just close everything. When you are left with a desktop and a start menu, you will still need to shutdown Explorer. To cleanly shutdown Explorer: Start->Shutdown->CTRL+ALT+SHIFT+Click 'Cancel' (for more info, see this post). You can use Task Manager (CTRL+SHIFT+ESC, File->Run...) at this point to open a command window. You should be able to go delete the index.dat. I have only tried this on XPSP2, but it should work anywhere.
thanks to Jeff for this information
Another way would be to boot either into safemode or dos to kill the file. Check out this index.dat program if you prefer a program to check and delete index.dat information.Advertisement