Hi!
I need a help. (
Internet explorer's Index.dat files have various URL record type like belows.
caches
History(global, weekly, daily)
cookies
PrivacIE
iecompatCache
ietldCache
feeds cache
userdata
DOMStore
REDR
Leak
and I can see some of those record types abovementioned on the record tab of EnCase after run comprehensive internet history search.
For anything I know, PrivacIe, IECompat, IETld, Feed Cache, Userdata and DOMStor record do not have a 'filetime value' (See 'MSIE Cache File(index.dat) format specification', you can google it.) But My Encase 6.18 shows that some record type(PrivacIe, IECompat, IETld, DOMStore) have a 'Accessed Time value"!
How can I UNDERSTAND that mystery? Where dose 'Accessed Time value' come from? Which are actual URL records indicating user's internet activies?
Is there anthing I should know more, plz be more specific.
thanks in advance. D