Why Can't I Delete My Browser History? |
 |
| by John Markovich | |
| April 10, 2003 | |
|
What they are, what they contain, how to remove them If you are using Windows, chances are that all your browsing history is stored in some hidden files. Even if most people are unaware of that, Internet Explorer keeps these records and does not delete them when you empty your browser cache. Just grab my index.dat viewer here and see what I mean. Then read the long story below about what they are. If you are like me, you don't want your computer to keep secrets from you. Every time I find a suspect file, I either open it with an editor or search the net for information about that file. Of course, opening a file with an editor does not make sense for binary files. You will only get a ton of nothing showing up. When I first discovered an ndex.dat file, it was because a friend told me about it. They are so well hidden by Windows and if you are not told about them it is very unlikely to find them. I immediately opened the file with an editor (I recommend using the hex editor located here - it is free) and I was amazed by its content. URLs I haven't even known to be surfing, files I opened months ago and a lot of cookies I thought I deleted. So I started investigating this file and trying to figure out how the information is stored in there. Here is what I found. What they are They are so-called Internet Explorer (IE) databases, where IE says it keeps track of the recent stuff you did related (more or less) with internet browsing. The reason it keeps this databases is the easy retrieval of the information (otherwise it would have to scan the temp directories every time it is searching for cache files). There are three kinds of index.dat files, all of them having the same structure but storing different kinds of information. 1. Temporary internet files index file. This one is storing almost all the addresses of the html and pictures you opened in your browser. Cleaning the temporary internet files won't help, it will only remove the files, but it will keep the records in this file. 2. Cookies index file. This file contains a list of cookies placed on your computer by sites you visited recently. Cleaning the cookies usually removes most of the records from this file, but there may be leftovers that were not deleted (usually less than 10). 3. History index files. These files contain all the URLs you ever opened on your machine. There can be more than one file; usually it creates one of every week. What they contain To have a look at the actual URLs contained in this files, grab my free index.dat viewer here. They contain records of your past internet activities. There are 5 kinds of records in these files: a. URL - this contain an URL and a reference to a local file where it is stored. b. REDR - this kind of records contain references to the pages that were not saved in the temporary internet files. Usually they are dynamic files. These are the most dangerous records, as they may contain sensitive information like passwords. c. LEAK - those are similar with REDR records, but for some reason they are named like this d. HASH - couldn't make much sense out of these records, probably here they store the indexes used to access quickly the data. e. BADFOOD - this is the information they use to fill up the space in the file. Funny guys, isn't it? What I have to say here is that, as you can see, these files are very dangerous, because they may store (and any person that knows what too look for can see) sensitive information about what you surfed and even your passwords or credit card numbers. How to remove them Well, many people have written about this. These files are permanently opened by windows (Windows Explorer and Internet Explorer open them). For the moment, the only way to remove them is during a reboot. This is because when the system reboots, they can get deleted before Windows Explorer starts. Another way to delete them is using a boot disk and booting in DOS. But with more and more Windows XP systems around, this is not an option (what I want to say is that this only works on Windows 95, 98 or Me). It may also be possible to clean them by overwriting their contents (there are several programs claiming they do this and it is technically possible. Removing them at reboot should work better in my view). I am researching a way to delete these files without rebooting, but I must say it involves some undocumented APIs and may take a long time to finish it. Rest assured that as soon as I find a way I will publish a freeware application that does this. If not possible I will release an "index.dat cleaner" application as an alternative to this. Until then, the only sure and painless way to remove them is by using a paid removal tool (didn't find any freeware that does this so far). I have reviewed many of these tools and I personally recommend one named NoEvidence. You can have a look at their site here: www.noevidence.com. If you have questions or comments about this article, you can contact me at john.marcovich@exits.ro . Yours, John Marcovich Webmaster and programmer www.exits.ro ----------------------------------------------------- This article is copyrighted 2003 by John Marcovich Permission is granted to reproduce it provided that all links and notices are kept and the author is notified about the reproduction. Have a question? Need help? Get free, friendly person-to-person help with your computer questions or spyware questions in our help forums! |
