IE10 forensics

I'm in a case and currently digging through webcachev01.dat with ESEDatabaseViewer from Nirsoft. In my case Container 1 & 3 contains Cookies. Are this cookies from visited pages or also third parties (pages in frames)? Default setting in our webbrowsers are drop third party cookies. But can i proove that with the containers?
When do IE switch between partition M and L?

I've read this article about internet cache history
https://cyberarms.wordpress.com/2012/08/21/windows-8-forensics-internet-cache-history/