Find visited urls and cookies of every user in index.dat
Updated • May 15, 2013
When you delete the visited urls and the cache in Internet Explorer after disconnecting your computer from the internet you are safe, right? Many users think that it is impossible to find out which websites they have visited when they delete the cache and the history. This is not true..
There is a file on the system that collects information about websites and cookies. It is called index.dat and is populated by default on Windows operating systems. The information are retained even if you decided to delete the browser cache and history.Microsoft surely has a good explanation for this, right? They say it is to speed up Internet Explorer but this sounds somewhat fishy, why would you need to keep a copy of cookies for instance if you have deleted them?
To find index.dat on your computer you need to do the following.
Open any folder, click on Tools then Folder Options.
Select View from the tab and uncheck "hide protected operating system files" and make sure "Show hidden files and folders is enabled".
Now search for index.dat and Windows will display all the files in the search results.
Note that this is handled different in newer versions of Windows. When in Windows Explorer, click on Organize and then on Folder and Search options. Follow the instructions posted above from this point onwards.
You can't just open the program in a text editor though. You need a specialized program to view the contents of index.dat files, and Pasco by Keith Jones is one of those applications. It is a freeware tool that you run from the command line. Download and unpack it to your system. You then need to open a command prompt in the following way:
Use Windows-R to open a new run box.
Type cmd and hit enter.
Change to the pasco directory using the CD command and enter the following command when you are there:
pasco index.dat > urls.txt
Pasco creates a text file with all urls that are saved in the index.dat file. You can then view the with every text editor available. The same works with the index.dat that holds the cookies of course.
Note that you need to either copy the index.data file into the same directory, or add the full path to the index.data file that you want to analyze to the command.
Ever wanted to know what your kids, husband, wife, friends, co-workers do when they are alone ? Use the index.dat file to find out.
How to remove the index.dat file:
The index.dat file is protected in windows and you will have a hard time deleting it from within.
These data files are used by Internet Explorer and Windows Explorer. You cannot delete a file that is in use by a running program. If you feel you need to delete the file, you will have to shutdown all instances of Explorer and IE. This includes applications that may host the Webbrowser control: Outlook, Messenger, IE, Product Studio, Visual Studio, Help, Windows Media Player, etc. Your best bet is just close everything. When you are left with a desktop and a start menu, you will still need to shutdown Explorer. To cleanly shutdown Explorer: Start->Shutdown->CTRL+ALT+SHIFT+Click 'Cancel' (for more info, see this post). You can use Task Manager (CTRL+SHIFT+ESC, File->Run...) at this point to open a command window. You should be able to go delete the index.dat. I have only tried this on XPSP2, but it should work anywhere.
thanks to Jeff for this information
Another way would be to boot either into safemode or dos to kill the file. Check out this index.dat program if you prefer a program to check and delete index.dat information.
Internet Explorer will be disabled through a Microsoft Edge update in February 2023
Still using Internet Explorer 11 on Windows 10? It will be disabled in February 2023
Microsoft explains how it is retiring Internet Explorer
Microsoft: please stop using Internet Explorer before it runs out of support next month
Internet Explorer 11 retires in three months
Internet Explorer 11 will be retired in June 2022 for most Windows 10 versions
Previous Post: « Stealth Web Page Recorder
Next Post: « Internet Explorer 7 final released
Oliver Alexander said on October 14, 2006 at 12:36 pm
Whacking a link to batchfile with the content
del /f /q "C:\Documents …\…\index.dat"
into the StartUp Startmenu group. That should do the job. If not the link is executed to late, then try putting a reference to the batch file in to the Registry "Run" section, where it seems to be reliably executed before Explorer.exe etc. start. Specify in the shortcut to the batchfile a "minimized" execution for speed.
Thus privacy is restored whenever the system re-starts.
A modification on the theme is, eg., to replace the cookies dat file with an appropriate one
mrA said on October 14, 2006 at 5:14 pm
Like not working. I found it at http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/freetools.htm
Martin said on October 14, 2006 at 5:21 pm
my link is working ;)
NAIF said on October 14, 2006 at 7:41 pm
Thanks a lot > :)
Filthy Jesus said on October 14, 2006 at 8:07 pm
You cold always jsut use CCleaner.
http://ccleaner.com
John said on April 15, 2008 at 3:44 pm
On the last statement:
'The new Internet Explorer 7 apparently fixes this issue.'
Beware! Index.dat files are now inactive and not generated with Explorer 7. Big Brother just came up with something better and more clever, and of course, he is not giving up. It will only be a matter of time until the new system is discovered, made public, and (hopefully) with solutions for deletion.
David said on February 11, 2009 at 10:52 pm
what about Macintosh Computer and Firefox browser. Is there an equivalent of the index. dat file? Can you retrieve cleared URLs?
Flash said on August 29, 2011 at 3:50 pm
Microsoft is so desperate to keep you away from Index.dat files that they keeps moving the goalposts via service packs and new versions of windows so what worked yesterday, won't work today.
Some of the 'Special Hidden' folders won't show even when you use a registry hack and killing processes 'Explorer' and 'IExplorer' before you try to delete them still won't unlock the files on Windows 7 X 64 (Build 7600) and running batch files without exposing account names and passwords cannot remove these index.dat files at reboot due to the wrong windows permissions.
One method that might still works is to boot-up in safe mode and then assign yourself administrator rights and then see if you can find the files to delete them
The method I now use is to create a batch file to rename the subfolder below the folder containing the index.bat files and to then only copy the folders back to the original location that don't contain these Spyware files but the resultant batch files needs to be run from a separate windows account that has full administrator permissions.
Click my name to learn more and to view the source code to do the job.
Published in: December 17, 2022 7:03 am | Updated in: December 17, 2022 7:03 am
Published in: October 30, 2022 5:47 am | Updated in: October 30, 2022 5:47 am
Published in: June 15, 2022 7:14 am | Updated in: June 15, 2022 7:14 am
Published in: May 2, 2022 6:55 am | Updated in: May 2, 2022 6:55 am
Published in: March 18, 2022 3:43 pm | Updated in: March 18, 2022 3:43 pm