Looking for a bit of help.
I have some behaviour that I don't understand!
I have approximately 1300 URL entries from the same live index.dat file that all have the exact same Last Visited date. I have parsed it with NetAnalysis v1.55, IEF v5.6.7 and have manually decoded some of the dates.
All produce the same results.
My suspect is using Bing search bar, but these items have directly come from the live index.dat.
Some of the searches are very notable for my Officer and I need some assistance ASAP please!
Thanks!
If you view all files in your image from the perspective of a timeline, do other files have identical or proximal modified timestamps which provide context?
I gotta go with Fab…what does a timeline show you?
The only items of note that I can identify as being accessed, created or written to are
– Jump List for IE
– LastActive Session Restore
– Crash Report for Vodafone mobile broadband
Jump List for IE is to be expected.
LastActive Session Restore was my first inclination of this behaviour but there are 1300 entries, which would probably breach the limit of tabs you can have open!! And secondly when I mount the files from the LastActive and conduct a search for my notable searches in Unicode, I do not get any hits back.
The mobile broadband crash may account for this behaviour but it didn't happen at exactly the same time. Would this cause all URL visited links to report the same time in the index.dat?
( a wee bit stumped with this!
I don't even get out of bed unless I've got 1300 tabs open.
Have you run a virus scanner against the data?
Are these weekly index.dat files? Found in a folder like MSHist012012091720120924?
What offsets in the URL record is this date found?
one of my colleagues has found that in IE if a user opens their history tab, and it populates, then it will update their last visited time.
i had a similar problem when it looked like a user had visited about 30 different websites at the exact same time to the second (although i didnt check the second)
What i could guess, but youd need to test it, is that the user has opened their entire browsing history in IE and its updated all the last visited times
Any progress sheona_17dec ?