index.dat question

Maybe I should have stated this also.

The reason I ask if it means that the history has been deleted is,

I found East-Tec Eraser 2006 on the PC.

http//www.east-tec.com/consumer/eraser/

I do not know the answer, but out of curiosity, I'd love to hear what you guys have to say!

Hi, can you tell which program you used to extract the data?

Index Dat Spy

http//www.stevengould.org/software/indexdatspy/screenshots.html

Thanks

-SS

Thanks for the link )

Hello secret_squirrel,

As you can see in the screenshot on the named site, the blank lines with a size of 128 bytes are referring to redirection URLs (called REDR). You can find more information on "http//en.wikipedia.org/wiki/URL_redirection". It has nothing to do with deleted files. I hope this helps your investigation!

Hello secret_squirrel,

As you can see in the screenshot on the named site, the blank lines with a size of 128 bytes are referring to redirection URLs (called REDR). You can find more information on "http//en.wikipedia.org/wiki/URL_redirection". It has nothing to do with deleted files. I hope this helps your investigation!

I noticed that.

But in my case they are not preceeded by REDIR.

The first 10,800 lines are visited pages, then for some reason there are another 20,000 lines that are all BLANK with size of 128.

I just thought it was interesting that there 40,000 lines in this .DAT file and only the first 10,800 were occupied.

Then of course I found that East-Tec Eraser software and I had to be sure.

Thanks for the input!!

They are not redirects - you do not get REDR entries in history files, only cache.

Secondly, the reason the software is showing blank, is because it is reading the hash table and extracting your entries - those entries have been overwritten. The software is adding the word "blank".

This software has not been written for forensic use?