A bit about WinInet's Index.dat

Microsoft's secret record of every website visited on your PC ?? - 2

Pranav ... Blogging — Sat, 05 Aug 2006 02:56:43 GMT

Continuing the discussion in the previous post, offcourse index.dat is not a secret record of any kind,...

re: A bit about WinInet's Index.dat

wagahai — Sat, 05 Aug 2006 04:26:40 GMT

index.dat was the reason that I switched to Firefox.

I do not want any of that information cached. I would set history to 0 days. The best that I could do for Temporary Internet files folder was setting it to 1MB, etc. Nevertheless, huge amounts of information were recorded.
For years I would repeat the same old clearing of the various cache files.
This was very tedious, so I eventually wrote a utility to do this for me. I was amazed at how much was cached, and went to further and further extremes to remove it. However, I could never get it all; the provided APIs left much behind. There were some values stuck in there from several years before.
But, I would remove what I could.
I would run this utility dozens of times a day.

Then I heard that Firefox has a feature to automatically clear all of it's cache. I broke down and tried it. It doesn't store it's cache in the index.dat files. I investigated it's storage system. When it cleared the cache, it could actually clear it _all_. And this could be done automatically. This was the single reason that I switched to Firefox.

I am aware that IE7 will have a similar feature (of course). I will give it a try. Depending on how thorough it removes the cache, I will decide my browser.

My remaining problem is that index.dat is a system component. It is used for system-wide caching from other applications, not only by IE. So I still need to constantly run my utility to clear as much as I can. But at least I don't have to worry about URIs being in there.

I am looking forward to "Cover My Tracks."
I do not want index.dat. Allow me to disable caching permantantly, for the whole system. It has been a source of frustration for years. Speed is not a problem. I spend far too much time just trying to remove that information. Or at the very least, provide an option to clear the various index.dat files at system startup / shutdown. That way you would not have to worry about corrupting other applications.

Call be paranoid, but I do not care to leave a trail of bread crumbs detailing my actions for a period of time.

Interesting Finds: August 4, 2006

Jason Haley — Sat, 05 Aug 2006 05:40:46 GMT

re: A bit about WinInet's Index.dat

Mike — Sat, 05 Aug 2006 09:54:13 GMT

I think this post is misleading. The ability to delete cookies has been available in Internet Explorer just about forever. The real problem behind index.dat is that whether or not the indexes inside are still relevant or not, it keeps named urls forever. This is a privacy issue. Any application can read index.dat and figure out which sites I visit, without me knowing.

As a user, I want to be able to turn on an hypothetical "auto-delete" of everything either anytime the web browser is restarted, or windows is restarted, or even on a schedule basis. I don't think IE7 is going to provide any of this, unless I have missed something.

re: A bit about WinInet's Index.dat

Jorrit Schippers — Sat, 05 Aug 2006 13:54:18 GMT

Why is the directory still called IE5? It's exactly those kind of legacy thingies which frustrate me about MS software. The fact that UA string additions can be stored in HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform as well as HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform is just another example of this.

re: A bit about WinInet's Index.dat

Nicholas — Mon, 07 Aug 2006 04:33:14 GMT

I agree on the legacy comment by Jorrit-- why not start using a new folder name? Isn't there a "system variable" for that system directory, much like there is one for "MyDocuments" and "Windows" ?

Also, I remember there being issues with the index.dat becoming corrupted or full. This is what leads to the "right click-> view source -> nothing happens." bug, right?

That's why I use CacheSentry [http://www.enigmaticsoftware.com/cachesentry/] sometimes.. but wish it would just be fixed in the source!

A bit about WinInet’s Index.dat – Q&A

Windows Network Development — Tue, 08 Aug 2006 02:56:33 GMT

In my previous post I tried to explain a bit about what the index.dat files are and what has changed...

re: A bit about WinInet's Index.dat

wndpteam — Tue, 08 Aug 2006 03:01:59 GMT

I've responded to a number of the questions asked here on the next post: http://blogs.msdn.com/wndp/archive/2006/08/07/WinInet_Index_dat_Q_and_A.aspx.

-- Ari

A look inside WinInet's index.dat file and changes in IE7 and Vista

The Old New Thing — Tue, 08 Aug 2006 17:00:23 GMT

The mysterious history file.

re: A bit about WinInet's Index.dat

Adam — Tue, 08 Aug 2006 19:27:29 GMT

"The visited container [...] is how IE can do URL auto completion and mark the links that you have visited a different color. [...] Visited only needs to know about each URL once, since you have either visited the site or you haven't."

I suppose ... but you could do much nicer things if you kept a count of the number of times a URL has been visited. Like order the autocompletion list by most-visited instead of just alphabetically. This is one thing that FF does that I really miss in IE when I use it.

For example, if I type "http://blogs" in my FF address bar, the top 10 items in the autocomplete list are:

http://blogs.msdn.com/
http://blogs.msdn.com/oldnewthing/
http://blogs.msdn.com/jensenh/
http://blogs.msdh.com/michkap/
http://blogs.msdh.com/ie/
http://blogs.msdn.com/larryosterman/
http://blogs.msdn.com/ericlippert/
http://blogs.msdn.com/robmen/
http://blogs.msdn.com/michkap/archive/2006/08/01/685351.aspx
http://blogs.msdn.com/jensenh/archive/2006/08/04/688355.aspx

That's great! It gives me the links I visit most - the blog front pages, before any individual articles. If I did the same in IE, it would start with Abhinaba's blog front page, and then list every single entry of his I've ever read, probably followed by Brian Jones and every article of his I've ever read, etc... despite the fact that I don't care /that much/ about those guys blogs (interesting as they are). That really sucks in comparison to FF.

Even ordering by most-recently-visited would be better than alphabetically. (Could this be implemented with the history info?)

Also, if you're parameterizing variable path elements, the cache path for FF is more like:

Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<random>.default\Cache

The <random> part is there so that if a security vulnerability allows an attacker to read arbitrary files on your HD, the attacker still has some work to do before they can read your cookie/password/history/settings/etc... files.

re: A bit about WinInet's Index.dat

Mark — Wed, 09 Aug 2006 00:41:56 GMT

FYI, if you want to decode the contents of the Index.dat file, here's a forensics tool to do that. (Useful if you want to see what websites may have done nefarious things to Internet Explorer):
http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/pasco.htm

re: A bit about WinInet's Index.dat

zzz — Wed, 09 Aug 2006 19:37:34 GMT

Does this mean that a forensic company/police has to actually read the HDD with some special tools (might need to open it physically up) if they need to have access to visited urls after user cleared up them easily with IE7? Or maybe they elect to try get the urls from ISP but hey, someone might have been using your wireless access and now it's harder to tell the police it wasn't you since it was your ip but you had just yesterday cleared the cache.

re: A bit about WinInet's Index.dat

sery0ga — Mon, 28 Aug 2006 12:04:41 GMT

I have to analyze visitors history in a local net but i can't find by which way I can pass to WinINet caching functions locations of files. Then, I have set of index.dat files on server, certainly, in different folders. How can i read them using WinINet?

re: A bit about WinInet's Index.dat

myob — Tue, 12 Sep 2006 09:52:03 GMT

What about people with older computers or operating systems who can't get IE7? How do they delete that info stored about them?

re: A bit about WinInet's Index.dat

wndpteam — Tue, 12 Sep 2006 20:14:32 GMT

myob: I'm sorry to hear that you are not running XP or 2003. I'm not aware of an easy way to cleanup these files on previous versions of IE.

re: A bit about WinInet's Index.dat

SJ — Tue, 29 Jan 2008 22:37:55 GMT

where do i go on the site to get the forensic tool to decode the index

re: A bit about WinInet's Index.dat

TJ — Fri, 27 Jun 2008 06:49:23 GMT

I created a batch file (below) that cleans up a bunch of stuff including clearing IE's history, cookies, temporary internet files, and index.dat files. I run it (via a shortcut) whenever needed. Also, I'll periodically log off then log in as a different user (with admin privs), which releases the index.dat files for that profile. Then upon running the batch file, all the index.dat files are deleted. After logging back in as the regular user, the files are recreated.

rmdir /S /Q "C:\Documents and Settings\user\Application Data\Adobe"

rmdir /S /Q "C:\Documents and Settings\user\Application Data\Macromedia"

rmdir /S /Q "C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\UserData"

del /F /A:H /Q "C:\Documents and Settings\user\Local Settings\Application Data\*.db"

del /F /Q "C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Media Player"

del /F /Q "C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Media\11.0"

del /F /Q "C:\Documents and Settings\user\Application Data\Microsoft\Media Player\*.wpl"

del /F /Q "C:\Documents and Settings\user\Application Data\Microsoft\Office\Recent"

del /F /A:H /Q "C:\Documents and Settings\user\Application Data\Microsoft\Office\Shortcut Bar\*.tmp"

del /F /A:H /Q "C:\Documents and Settings\user\Cookies"

rmdir /S /Q "C:\Documents and Settings\user\Local Settings\History"

rmdir /S /Q "C:\Documents and Settings\user\Local Settings\Temporary Internet Files"

del /F /Q "C:\Documents and Settings\user\Local Settings\Temp"

rmdir /S /Q "C:\Documents and Settings\user\Local Settings\Temp"

mkdir "C:\Documents and Settings\user\Local Settings\Temp"

rundll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

pause

exit

re: A bit about WinInet's Index.dat

HawkPunk — Sat, 29 Aug 2009 01:45:24 GMT

You can read these files using index.dat Viewer™, available for free at http://www.pointstone.com/products/

~Hawk~

A bit about WinInet's Index.dat

Microsoft's secret record of every website visited on your PC ?? - 2

re: A bit about WinInet's Index.dat

Interesting Finds: August 4, 2006

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

A bit about WinInet’s Index.dat – Q&amp;A

re: A bit about WinInet's Index.dat

A look inside WinInet's index.dat file and changes in IE7 and Vista

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

re: A bit about WinInet's Index.dat

A bit about WinInet’s Index.dat – Q&A