Anyone knows the reason for paths to files in the local PC (ex; d\temp\ms word\evidence.doc show up in the index.dat file? ?
jmartinez4
Depending on the location (e.g. temp location or specific user location on the drive) it is most likely due to the user typing the location of the file in the Internet Explorer address bar within the IE window to open the file vs. either clicking on it or typing it in the 'run' field
With index.dat files other activity can also be recorded, such as file viewing or access. Where a 'registered' Windows file is accessed, an entry in the index.dat file is made.
Andy
The document was actually in the d\data\word\evidence.doc and the reference in the index.dat is the same. The NTUser.dat file says the file was in the IE cache at one point but the file is no longer cached in there. The local pc firewall logs show the document going over the firewall but doesn't show the direction the document was traveling in. I'm trying to figure out if this guy sent or received this document over the Internet.