Recovering Browser Cache

[Miggsy]

A couple of days ago my 12 year old daughter cleared the cache on our computer. The act alone has set alarm bells ringing.

Is there any way I can recover the cache? We are using Mozilla Firefox.

Thanks,

Miggsy

[Shrekkie]

Try to look in /Documents and settings/<user>/Application data/yourFirefox/ Profiles/...

There it normally saves its cache i believe, maybe others can enlighten here, cause i don't
work in windows that often anymore.

Btw did she also deleted history files ? Also a firewall or alike do show in logs where you visited.
often it even shows url's. Hope this helps.

Cheers

[Miggsy]

Thanks Shrekkie.

I checked the cache file, that's how I realised it was her that did it because of the time of the earliest recorded activity. There is still history there but I'm fairly certain that she knows that if you right click practically anything you can delete individual items (including history items).

I didn't realise that there might be some traces on the firewall so I'll check that.

Thanks again.

[nihil]

Remember to check file size and number of days storage, as these things will automatically delete stuff anyway. As do a variety of clean up and maintenance programs.

Incidentally, it is good practice to clean the cache out regularly, both from a stability and a security viewpoint................a variety of problems can be resolved by emptying the cache.

Perhaps you should consider parental control software?

Cheers

[White Scorpion]

or use a tool like undelete, and try to see what you can recover from your C disk, if you let it search for temp files too, it should at least be able to come up with all the cookies that were last on it (that is if it is not overwritten yet).

[|3lack|ce]

You can still get a good picture of where she's been by checking the cookies folder under her user profile. Take a good hard look at the temporary internet files too...

[edit] for the future, I suggest getting a watchdog program for your machine - logs everything, including keystrokes. This is how I keep tabs on my grandkids when they're down for a visit. I use McAffe's 'guard dog' but I know there's several others out there.
Hope that helps![/edit]

[Cyberruk]

I will assume you are using Windows XP. Browse to your daughter's folder:

Get the tool INDEX.DAT File viewer:

http://www.exits.ro/index-dat-viewer.html

Install it for yourself. Now browse to the following directories and one at a time, copy the INDEX.DAT files to a temporary directory from your daughter's. INDEX.DAT files are NOT deleted when the cache is cleared by the user.

c:\Documents and Settings\USERNAME\Local Settings\History\

also do the same for Temporary Internet Files and Cookies

Using the tool above, you will be able to view all of the sites your daughter has visited with date and time stamp. Further, you can export to a CSV file which can be imported into Excel for easier manipulation and viewing.

The time stamp is in GMT (Greenwich Mean Time) which means you have to correct for your location (ie: to correct to EST - subtract 5 hours from GMT; to correct for EDT - subtract 4 hours from GMT).

HTH

Cyberruk

[Falcon21]

Type: about:cache in the address bar in Firefox or Mozilla to see if it turn up something

[cream47]

Wow, I didn't know about the index.dat files. Thanks for telling me about them Cyberruk and the cool index.dat viewer.

[pkm]

The index.dat viewer will add or alter three registry keys and your "Spyware" app may also pick certain objects up as such, if you have run this programme. Also, I presume you use XP - this app is only supported under Windows in any case;

"http://www.superwebsearch.com/ie/" will be added to the keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search
(Value:SearchAssistant)

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search
(Value:SearchAssistant)

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
(Value:Search Page)

Just thought you may need to know this.