IE Internet Activit...
 
Notifications
Clear all

IE Internet Activity REDR records

2 Posts
2 Users
0 Likes
327 Views
(@joe_bowman)
Posts: 11
Active Member
Topic starter
 

Hi,

I am looking at some IE Internet history records. I loaded them into NetAnalysis 1.5.1 and came across a bunch of URLs that are relevant to my case.

However, they all appear to be REDR entries.

Notably;

* Some 'googlead' entries, where the page URL contains a 'ref=' parameter containing an URLEncoded Google search URL that, decoded, contains the 'q' (query) parameter that contains relevant terms.

* The Google 'setprefs' page where it appears to me that the user has set 'safesearch' to 'off' (the parameter 'safe' = 'off') http//images.google.com/setprefs?… containing parameter 'prev' which again is URL of google search containing relevant terms

Yet in both cases (and there are many instances of each) amongst other pages, there is seemingly no evidence to suggest that the user has conducted the Google search associated with those terms.

Do REDR entries even have corresponding URL entries for the pages the user has been redirected to?

I parsed the index.dat files by hand, but am still none the wiser as to how to link these redirects to dated records!

Any ideas?

Thanks in advance!

Joe

 
Posted : 20/07/2010 6:26 pm
rcw8892
(@rcw8892)
Posts: 27
Eminent Member
 

Hi

If you look in the Digital Detective Knowledge Base, there is an article which covers redirect entries.

KB80053 Understanding Redirects

The "Redirect URL" column shows you where the user was redirected to.

 
Posted : 20/07/2010 6:46 pm
Share: