Hi all,
I am pretty new to CF and have an issue with the timestamps I find in the index.dat file.
What I want to do I want to build up a timeline of the surf activity of a user. In my opinion the best thing to do was to use the index.dat file in the Internet temprary Files since this file will give me the URL and the file in the cache. I noticed that I have a last visited timestamp and a last modified timestamp. ?
I decided to build up the timeline based on the last visited timestamps. However at a certain point I observed that some last modified timestamps were more recent than the last visited timestamp. How is that possible? I could of course also use the History index files but these don't seem to include all activities….at least in my case.
BTW I analyzed the file with pasco, netanalysis and FTK and all of them show me the same phenomenon.
Thanks for some advice. )
The last modified time field is when the information was changed on the web server. The last accessed time field is when the last time Internet Explorer visited the URL. Without knowing if the time/date is correct on the web server it would be difficult to rely on that field as an absolute.
That is interesting? Would it be common practice for a web server to set dates for future times to force a re-download of content? Didn't seem right to me, so I was hesitant to comment initially, but you confirmed my initial thoughts.
I should also add that last modified time is GMT where last accessed time is local.
From another post Some scripts / tools apply the local offset to all dates as most are stored in GMT. Note that if the local time offset is applied to the first date for daily and weekly history, this timestamp will be incorrect as the offset will have been applied twice, once by MSIE and once again by your tool or script.
So If I want to reconstruct a history of the websurfing I am better off using the Last visited time stamp considering the timezone of course.
I want to base my history reconstruction on the index.dat file which is located in the temporary internet files (cache). Is this ok or should I consider other files. I will of course have a look in the index.dat files of the cookies and history directory to ensure that nothing is missing in the index.dat file of the cache.
Does this make sense?
Thanks for your help…I appreciate a lot.