Notifications
Clear all
Topic starter
19/10/2011 4:20 pm
I have used EnCase to extract .dat files containing the Internet History for a user. There is minimal Internet history after viewing the .dat files in CacheBack and some other tools and I believe the user has cleared their cache deliberately or their browser was set to empty it on closure.
Is anyone aware if there is a registry entry (Vista) that contains the date and time the Internet Browsing History was deleted, or if this information would be stored in one of the Event logs.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs was also clean of any entries.
Thank you