Recover IE 7.0 websites visited?

[Guest Ed Flecko]

I have an employee who's been surfing "questionable" sites, and

infected his PC with some nasty viruses. He uses IE 7.0, clears his

sites, cache, etc., and SWEARS he hasn't been hanging out at these

sites.

 

Is there any way of recovering a list of sites that a user has visited

in IE 7.0 (like there used to be with IE 6.0) after he's cleared his

cache, history, etc.?

 

Also, system restore is not turned on in his case, so I can't use

that.

 

Suggestions???

 

Thanks.

[Guest Shenan Stanley]

Re: Recover IE 7.0 websites visited?

 

Ed Flecko wrote:

> I have an employee who's been surfing "questionable" sites, and

> infected his PC with some nasty viruses. He uses IE 7.0, clears his

> sites, cache, etc., and SWEARS he hasn't been hanging out at these

> sites.

>

> Is there any way of recovering a list of sites that a user has

> visited in IE 7.0 (like there used to be with IE 6.0) after he's

> cleared his cache, history, etc.?

>

> Also, system restore is not turned on in his case, so I can't use

> that.

>

> Suggestions???

 

If you are not already tracking the internet activity (for everyone or that

machine) in some other way - and his cookies/TIF files are actually

emptied - then there is nothing retro-active (that I know of)you can do.

 

Also - System Restore restores system files - it would have no effect on the

user's files.

 

Does this user have rights beyong "user"? If so - why?

 

--

Shenan Stanley

MS-MVP

--

How To Ask Questions The Smart Way

http://www.catb.org/~esr/faqs/smart-questions.html

[Guest Ed Flecko]

Re: Recover IE 7.0 websites visited?

 

On Feb 17, 5:16 pm, "Shenan Stanley" <newshel...@gmail.com> wrote:

> Ed Flecko wrote:

> > I have an employee who's been surfing "questionable" sites, and

> > infected his PC with some nasty viruses. He uses IE 7.0, clears his

> > sites, cache, etc., and SWEARS he hasn't been hanging out at these

> > sites.

>

> > Is there any way of recovering a list of sites that a user has

> > visited in IE 7.0 (like there used to be with IE 6.0) after he's

> > cleared his cache, history, etc.?

>

> > Also, system restore is not turned on in his case, so I can't use

> > that.

>

> > Suggestions???

>

> If you are not already tracking the internet activity (for everyone or that

> machine) in some other way - and his cookies/TIF files are actually

> emptied - then there is nothing retro-active (that I know of)you can do.

>

> Also - System Restore restores system files - it would have no effect on the

> user's files.

>

> Does this user have rights beyong "user"? If so - why?

>

> --

> Shenan Stanley

> MS-MVP

> --

> How To Ask Questions The Smart Wayhttp://www.catb.org/~esr/faqs/smart-questions.html

 

No, he has no elevated rights/privledges; he's just a normal domain

user. I'd just like to be able to PROVE that he's been hanging out at

websites that he SAYS he has not.

 

Arghhh.

[Guest Shenan Stanley]

Re: Recover IE 7.0 websites visited?

 

Ed Flecko wrote:

> I have an employee who's been surfing "questionable" sites, and

> infected his PC with some nasty viruses. He uses IE 7.0, clears his

> sites, cache, etc., and SWEARS he hasn't been hanging out at these

> sites.

>

> Is there any way of recovering a list of sites that a user has

> visited in IE 7.0 (like there used to be with IE 6.0) after he's

> cleared his cache, history, etc.?

>

> Also, system restore is not turned on in his case, so I can't use

> that.

>

> Suggestions???

 

Shenan Stanley wrote:

> If you are not already tracking the internet activity (for everyone

> or that machine) in some other way - and his cookies/TIF files are

> actually

> emptied - then there is nothing retro-active (that I know of)you

> can do.

>

> Also - System Restore restores system files - it would have no

> effect on the user's files.

>

> Does this user have rights beyong "user"? If so - why?

 

Ed Flecko wrote:

> No, he has no elevated rights/privledges; he's just a normal domain

> user. I'd just like to be able to PROVE that he's been hanging out

> at websites that he SAYS he has not.

 

Then how did he infest/infect the machine with anything? He wouldn't havew

the rights needed to mess up much more than his own profile...

 

Anyway - in order to track the Internet usage - you need a proxy server.

You could set up one and just point that one machine to it or do it for your

whole domain. Up to you.

 

You could also install software to track the usage... Usually this is

marketted for parents - but, same idea.

 

Retro-actively, if something is not already monitoring stuff, you have

pretty much nothing. Sorry. :-(

 

--

Shenan Stanley

MS-MVP

--

How To Ask Questions The Smart Way

http://www.catb.org/~esr/faqs/smart-questions.html

[Guest MAP]

RE: Recover IE 7.0 websites visited?

 

Even if a user clears their ie cache, sites visited will still be in the

index.dat files (forever or until deleted with a third party program such as

ccleaner),however opening this via notepad shows a mess of information with

the websites mixed in very hard to read,their are several free programs that

will display this file in a readable manner.

 

I have used this free viewer before when I first heard of it and it works

well.

http://www.softwarepatch.com/software/indexdat.html

 

or choose another.

http://www.google.com/search?hl=en&q=index.dat+viewers

--

Mike Pawlak

 

 

"Ed Flecko" wrote:

> I have an employee who's been surfing "questionable" sites, and

> infected his PC with some nasty viruses. He uses IE 7.0, clears his

> sites, cache, etc., and SWEARS he hasn't been hanging out at these

> sites.

>

> Is there any way of recovering a list of sites that a user has visited

> in IE 7.0 (like there used to be with IE 6.0) after he's cleared his

> cache, history, etc.?

>

> Also, system restore is not turned on in his case, so I can't use

> that.

>

> Suggestions???

>

> Thanks.

>

[Guest Daave]

Re: Recover IE 7.0 websites visited?

 

Ed Flecko wrote:

> I have an employee who's been surfing "questionable" sites, and

> infected his PC with some nasty viruses. He uses IE 7.0, clears his

> sites, cache, etc., and SWEARS he hasn't been hanging out at these

> sites.

 

Other than "nasty viruses" (which can often be the result of e-mails

and/or a poorly patched system), what makes you think he has visited

"questionable sites?" Isn't it possible he's telling you the truth?

Which particular sites do you think he has visited?