I have a PDF titled "Forensic Analysis of Internet Explorer Activity Files" written by Keith J.Jones, a lot of you probably know this paper which discusses analysis of the index.dat file in hex within the Content.IE5 file in order to reconstruct web page content. I've read through it, although was unable to follow it further than locating the index.dat file size and the four directories with randomly generated names.
(I'm using XP) Whats puzzling me is
A.) The paper states that immediately after the file size the hex value for the location of the hash table should be located, in the paper the value happens to be "00 50 00 00", which gives the correct location. However, when analyzing the index.dat file on my system this value is "00 00 00 00", so i am unable to locate the hash table. When i look through the ASCII, i am also unable to find a "HASH" string, which should be present at the beginning of the hash table.
B.) Although i am able to locate the hex values for the directories with randomly generated file names, the directories do not appear in the Content.IE5 file within the index.dat.
C.) The Temporary Internet Files folder for any profile other than Administrator on my OS does not even contain a Content.IE5 folder.
I think that there are probably some relatively simple explanations/solutions for the above and would really appreciate it if anyone could provide me with them.
Many thanks