In short – probably not. There are a couple of approaches that might work, if you’re lucky, and perhaps desperate enough.
First, we need to locate where the history is kept.
Become a Patron of Ask Leo! and go ad-free!
For Windows XP, Internet Explorer’s history is kept in a per-user directory underneath “\Documents and Settings”. Assuming a default location, that would be:
c:\Documents and Settings\Username\Local Settings\History
“Username” would be replaced by your login user name. So mine, for example, would be “c:\Documents and Settings\LeoN\Local Settings\History”.
Note: the “History” directory is marked “invisible” by default, so it’s likely that you won’t find it by default. You’ll need to enable viewing hidden files in Windows Explorer, or searching for Hidden Files when you perform a search. In a Command Prompt, you can simply “CD” to it, even if you don’t see it.
The easiest way is to simply recover the contents of that directory, including all subdirectories, from a recent backup. If you’ve been making regular backups of your full system, as recommended, then you can simply use your backup utility to restore only those directories, after which you should be able to restart IE and have the old history restored.
Alternately, and with an even lower chance of success is to see if you can “undelete” an older version of the files found in that directory. If you get very lucky you might be able to undelete or recover a file that has the history you want. I do not recommend this approach, simply because the chances of it working are so very low.
Ultimately, I believe that the chances for successfully recovering this data is so low, that it is effectively zero.
I will throw out one last approach – but it’s expensive, potentially time consuming, and really only for the most dire of circumstances. It is sometimes possible, using advanced data recovery techniques, for a data recovery service to recover this type of data. You’d be sending them your hard disk, and you’d be writing a fairly large check. There are many factors involved, and it’s definitely not as easy as you might see on TV, but it can, sometimes, be done.
Just a thought …
I know one program that can nicely check/recover/export the contents of any “index.dat” type of file. It’s a CLI application from Foundstone called “pasco”; please see here for the program’s description: http://www.foundstone.com/resources/proddesc/pasco.htm and optionally you can download it here: http://www.foundstone.com/resources/termsofuse.htm?file=pasco.zip
best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)
Yes Leo, you’re completely right …
Files can be deleted and can be *deleted*; meaning that you can “recycle” a file (i.e. move it to the Recycle Bin), and then issue an “Empty Recycle Bin” command/operation, which in fact doesn’t delete the actual contents of the (physical) file on a hard-disk, but it only makes these areas available for future writes; as Leo has already written in the article.
And in my opinion this is somehow similar to reformatting a partition, i.e. the actual data are not overwritten (like in case of the so-called “low-level” format; where the hard-disk is overwritten by zeros or random patterns), but only “marked” as non-occupied, however, the actual data are physically still intact on the hard-disk and can be therefore easily recovered till this area on hard-disk is written to for the first time after deleting the respective file. But even then the data can be retrieved by forensic professionals; but please don’t ask me how, because I simply don’t know.
From my own experiences, I would recommend two programs; as first an application called “Handyrecovery”: http://www.handyrecovery.com/index.shtml (it was free back then when I’ve used it, but I think it’s not anymore) and “PCInspector – File Recovery”: http://www.pcinspector.de/file_recovery/welcome.htm, which is a program that besides recovering deleted files can even resce files from corrupted hard-disks and partitions.
P.S., If anyone is interested, please read the “I ACTUALLY DID IT … I rescued the data from a totally screwed disk !!” thread: http://episteme.arstechnica.com/eve/ubb.x/a/tpc/f/99609816/m/758006059631, that I opened on ArsTechnica forum back then for more info on how I managed to get most of my data back from a totally corrupted/screwed partition with a PC Inspector – File Recovery program mentioned/linked above.
best regards,
Ivan Tadej, Slovenija, Europe
http://www.tadej-ivan.be (redirect)
http://users.volja.net/tayiper (direct)
In Windows XP SP2 – the history absolutely CAN be restored – by using System Restore. I just did it.
In reference to Posted by: Warren Whitney at July 26, 2006 05:35 AM, does doing a system restore affect anything else? How far back will it retrieve the internet history?
Hello!
You have a chance to restore history using 3-rd party software. Then you deleting history links from IE it does’t delete all information related to visited sites.
1. History index.dat file can contains Host: entries, for visited sites. These records does’t contain full path to visited pages but shows you visited sites.
2. You can explore Internet Explorer cookies and find visited domain names.
3. You can explore address bar history for domain names.
4. You can explorer Temporary Internet Files records and view visited domain names and visited URLs.
I my case i use IEHistoryX from http://www.585Soft.com, this tool is easy to understand and use and got all needed tools to work with history, cookies, cache entries.
Windows keeps IE history in the index.dat files which are locked and can’t be deleted in Windows platform.
History Killer (from Emergency Soft) can delete index.dat files and erase IE history.
http://en.emergency-soft.com/category/historykiller
Leo,
Good article, and good comments. There’s something that I think may have been left out, however. The discussion has centered around deleted index.dat files, but there is also a lot of Internet history left lying around when the History truncates its file by default. The user may have one or two weeks of history kept, but the old history doesn’t just go away. It gets truncated, and orphaned off into unallocated space. So the text containing those history entries is a rich source of information for computer forensics guys like me. It is not unusual for me to find hundreds of thousands of old Internet history entries (I’m not exaggerating) by using various forensic utilities. There is information about this and related issues on my article pages – I hope it’s okay to put that reference here: http://www.burgessforensics.com/articles.php
Thanks for your good work!
-Steve
Hi Leo great site thanks could either you or warren answer this one?
To Warren Whitney
re using system restore
Please can you tell me exaclty how you used system restore. I have windows xp etc and have carried out the system explore procedure and sure enough the list (ie the list: ‘x weeks ago’) has returned & for a minute I rejoiced but they do not expand ie they seem to be empty.
All your internet history is kept by Windows in the locations already mentioned. Obviously it’s possible to see part or all by undeleting files which is how police see what sites you’ve visited.
Whether it’s possible to reconstruct it in a fashion which you can re-use is another question.
My Internet Explorer (v6) not only saves web sites but records every file I’ve opened on my own computer. Is there a way of stopping this?
Also, when I delete a just a few items from the history, one of IE’s many bugs causes the whole history to disappear after the fourth or fifth item is deleted! What happens to it?
When I am using internet explorer and go to view then history, it only shows today’s history as I deleted the tab that shows last weeks history. I regret deleting it and it want it to show last weeks history again. How do I get it to go back and show last weeks history again? This was deleted a while ago and I went back to my earlist restore point and it still wont show. Please help!
-Jo
I use Windows Vista, and have no history in IE. The dropdown is simply empty. I am not deleting it, and this situation has persisted through the recent installation of IE 8. I’m wondering if the history file is in a directory that can’t be written to. This is my own personal computer, so I should have full access, but I’ve noticed there are folders Vista won’t let me into. Is this the problem? Thanks,
Easy job!
I backup my system on regular basis.
Makes recovery so easy.
A lesson I learned a long time ago that you backup your system, period.
Very Interesting & Informative!
Is there a way to keep track of urls visited & their respective viewing time durations?
Thank you for this info. Spent ages trying to find the location of IE’s history files!
Cheers!
Thanks Leo, I’ve forgotten quite a lot in the past decades and especially with new stuff coming out all the time (if you don’t use it, you lose it). The last few languages I remember writing where C++ and cobalt. I changed career and my kids seem to think I’m a has been geek. Unfortunatly for them I’m also a good problem solver and for some reason my 17 year old lad deleted the history for his activity last night on the internet which I picked up on straight away(WHY?)Thanks for the help 008
hi Leo
i have deleted by accident on ccleaner my mozilla firefox history bookmark for my web sites i used to use so wont forget them and ccleaner have erased them now i can’t remember what the site is to look for can you help please
regards
k
hello!! thanks for your help already. how can i view the history on the computer if the history has been deleted. i want to see what sites my kids have been viewing but when i get on the computer they have deleted the history.
Help, I accidentally deleted my history and lost my bookmark on mozilla firefox. Is there any way I could get it back? Thank you.
If you have already logged off the computer you are using, the history is not available to retrievem but if you are currently still logged on, it is possible to get the history contents back.
Can I recover internet history if the account setting on the firefox browser was set to “never remember history”? If so, how?
10-Nov-2011
how about for windows 7?? thx!
18-Dec-2011