Printable View
I noticed that there's a file called index.dat in my cookies folder.I opened it and it said that it was locked for editing by 'another user'..funny...as I dont have another user on my comp(I'm not on a LAN either).I opened it up with read only priveleges,it was unintelligible.Any idea of what this could be?
Good Day,
www.google.com is your friend.
First page opened was:
http://www.acesoft.net/delete_index.dat_files.htm
Index.dat--What is Index.dat File ?
--------------------------------------------------------------------------------
Index.dat are files hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. Not only that but all of the email that has been sent or received through Outlook or Outlook Express is also being logged. The file names and locations depend on what version of Internet Explorer you have. If you are running IE version 4.0 or above, the file name is "index.dat". Microsoft has not supplied an adequate explanation as to what these files are for or why they have been hidden so well.
According to Microsoft, these files are used to cache visited Web sites to help speed up the loading of Web pages in Internet Explorer. Obviously this cannot be the case because when you clear the Temporary Internet Files the "index.dat" files remain behind and continue to grow. If you delete or clear the Temporary Internet Files, there is absolutely no need to index the URL cache because those files no longer exist.
On a Windows 9x computer these files are located in the following locations:
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
\WINDOWS\Cookies\index.dat
\WINDOWS\History\index.dat
\WINDOWS\Temporary Internet Files\index.dat
In Windows 2000 and Windows XP there are several "index.dat" files in these locations:
\Documents and Settings\<Username>\Cookies\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\index.dat
\Documents and Settings\<Username>\Local Settings\History\History.IE5\MSHist012001123120020101\index.dat
\Documents and Settings\<Username>\Local
Settings\History\History.IE5\MSHist012002010720020114\index.dat
\Documents and Settings\<Username>\Local
Internet Files\Content.IE5\index.dat
Index.dat files can be very hard to find. If you are in Windows, even with "Show hidden files and folders" enabled, index.dat files are not visible and cannot be found if you do a search for index.dat files. The reason that these files are so invisible is that they are not just hidden, they have been designated as "system" files. System files and folders are treated differently in DOS and Windows and are effectively cloaked from casual searches.
Index.dat files are always being used by windows system, you can not delete index.dat files manually, and even you clear Temporary Internet Files on Internet Option of Internet Explorer, it will not delete index.dat files.
Now that's scary stuff, you can use some utilities to delete them, as the ad says, but they are everywhere and ever-knowing! :eek:
umm yep,I had that much,just wanted to see if that was all it was...and the file was sitting right there in the folder lol..windows needs to hide files better;)
I've always seen them, but never really figured out how to remove the index.dat
If you were able to, wouldn't the computer stop logging all that info about those sites because the folder didn't exist? Once I deleted all the extra temp internet folders, and low and behold, the folder stayed empty. I don't know if it changed the path and put them somewhere else or what. But for the most part I didn't have to clean the temp internet folder any longer.. :D
cheers
edit: Found the answer as well. IE is completely integrated into the MS OS and just as quickly as I would delete it, Explorer would create another. You can delete the files in the index.dat folder with utilities or
Windows 95 and 98, reboot into MS-DOS mode and run the following commands at the command prompt:
cd windows
deltree /y cookies
deltree /y history
deltree /y tempor~1
If your computer runs on Windows NT, 2000 or XP, this is very easy. You simply log out of your normal account and into an account with administrator privileges. Create a new administrator account from Control Panel > Users if you have to do so.
Navigate to the folder locations using Windows Explorer and simply delete them. Since you are not logged into those accounts, Windows is not using them and they can be deleted normally. The next time you log on, Windows will try to open the index.dat files, find they are missing and recreate them and their folders from a default template.
In Windows NT, 2000 and XP, the folders are located in these locations:
C:\Documents and Settings\[Username]\Cookies\
C:\Documents and Settings\[Username]\Local Settings\History\
C:\Documents and Settings\[Username]\Local Settings\Temporary Internet Files\Content.IE5\
http://www.spywareinfo.com/articles/del_index.dat/
according to the above story, if you would do something illegal, or if someone with enough knowledge would get there hands on your system, they would be able to see every move you ever made.... not a pretty thought!!
perhaps it is possible to create a script, that can run as a service which automatically deletes the files at boot up or shutdown....
i'll get into that, its pretty interesting :)
lepricaun,
It should be easy enough to set up a batch to run at startup like you said and include cleaning out that junk. You might want to add whatever other cleaning you want to do as well.
For win98 you could include:
del C:\windows\ff*.temp
del C:\windows\temp\*.* > NUL
del C:\windows\system\advert.dll
del C:\windows\win386.swp
deltree /y C:\windows\recent\*.* > NUL
and from above:
deltree /y C:\windows\cookies
deltree /y C:\windows\history
deltree /y C:\windows\tempor~1
Now that would just about clean everything but the bathroom.... :D
cheers
:)
Search a bit more on AO. There are several threads, some quite recent, on how you can handle those pesky index.dat files.
Again, you can create batch files, that will delete the contents on restart or start-up, or you can also drag and drop them into the "shredder" of Spybot S&D. You'll have to restart the box
and your index.dat files will have a paltry 32 bytes in them.
I have accumulated quite a collection of batch files, scripts, articles and programs aimed at dealing with index.dat files. Hardware Hell has a substantial thread in their forum on batch files that users created to delete these files - ranging from Windows 98 to Windows XP . . . You cannot use the same batch file on every operating system. I've also found that what works on one system, may not necessarily work on another . . . even if they have the same OS and program setups.
If anyone is interested, I would be more than happy to supply copies of what I have. Here is the link for the Hardware Hell thread (http://hardwarehell.com/discus/messa...html#POST11208).
V.
This is all very curious, as I'm not sure whether these index.dat files were intended to track what you are doing or not.
I suspect not, and it is probably just down to out of date code.
However MS has never over the last 5 years given a reason for why these files exist in the first place, and what they are supposed to be used for ...
You can delete them all with no side affects, which can be done by various means depending on your environment - and even stranger it has no affect on how your system works :)
The simplest solution for WinXP is - boot in safe mode & then open a command prompt window. Type "cd:\" to get yourself back to the root directory (C:\) , and then "del index.dat /s" which will purge all of the little buggers ..
Incidentally, index.dat files are recreated at 32 bytes, but they will rapidly grow again.
However, the side affects are interesting, as you can see what someone has looked at using IE, even if it was 3 years ago :D
I would think that the index dat files are a deliberate addition to windows. This enables the authorities to gain evidence should they wish.
Software like Encase, wich the authorties use to gather evidence. Has the ability to extract typed urls from index dat files.
:)
Nice...
I suppose that getting out of safe mode is the equivalent of restarting the box.
Are there any native means within WIN to read the contents of the index.dat files?
I think that Corel Word Perfect merge may work as well.
I'll sniff some more.
I ran across this site, offering a "free" index.dat viewer, but read the EULA carefully.
It basically states that you agree to have your homepage of your browser changed,
or if you just click "I Agree", you'll end up complaining about your browser being hijacked. Ain't it sweet, all this freeware.
WARNING
http://www.exits.ro/index-dat-viewer.html
WARNING
download and execute at your own risk!!!
Sniff, sniff
Ok, 30 minutes later...
Here is IMHO a legit site with some cool freeware and it has a couple of simple
apps to view your index.dat files. I've d/l'd two zip files and scanned them, read the license agreements, and decided to take it easy and first install the utility that allows you to "only" read those .dat files. The other utilty allows you to delete them as well.
Interesting, to say the least...'cause there are some URL's I thought to be gone by now,
and no, not porn, LOL. However, some of you guys might be in for a surprise....
this is a cool app for all those snoopin' girlfriends with access to their boyfriends' box...
http://www.it-mate.co.uk/support/idsuite.asp
Index.dat QV , just a viewer...
Index.dat suite , a viewer and you can delete files...
Have fun browsing this site...and happy deleting.
Well, another edit...
I figured, what the heck, if I've gone this far, I might as well be a guinea pig.
I've uninstalled Index.dat QV , which had a rather benign GUI, and installed
Index.dat Suite version 2.5.5. This utility is much refined and features a "run once" setting in the registry that allows you to generate and run the batch file without having to run it manually. Just restart the box. It is important to note, that you have to go to "Settings" and check the files you want to delete. The GUI is a bit awkward at
first, but it took me 5 minutes and a couple of trips back to the website to sort it out.
Dang, all my index.dat files were squeaky clean. In retrospect, you can manually try to clean them by drilling into all the various folders (that's if you can find all of them) and drag and drop them into Spybot S&D, or use this neat utility. So, I've learned a bit more, which is quite satisfying. Well, I'm off to a defrag session now.
:)
What's really cool with the "Index.dat Suite" is that when you highlight a URL, you can open it from within the utility; there's some really weird sites that come up, once you've gone thru a few. I like this app.
I've never heard of these files before *smack*, I'll have to take a look on my machine when I get home.
:)
How long have you owned your box for? Let us know the size of the various index.dat files.
Oh, be forewarned. They say that when running the suite, it can take a while to get thru the search and then to generate the batchfile. I think it may apply to you, LOL.
Let us know...oh yesssssss, pleasssssse lets us know, our little precioussss......
meh, only 16 megs .. I was expecting more.
:)
Is that just one file that you were able to find, or the cumulative total. There's a whole bunch of them.
that's the total of all of them, can't remember how many exactly.
gunder -16 meg just for a bunch of text is actually quite a lot of data though!
One thing here is that these files can be beneficial in some circumstances.
Last weekend I was round at a friends house fixing a bizarre hardware/driver conflict he was getting.
This was a 4 year old, well maintained Win98 PC (patched, together with up to date AV & firewall).
Never been scanned for spyware though, so I suggested we should do this, and Adaware & Spybot turned up 210 items :D
However, my attention was drawn to the sextracker cookies that were detected :eek:
When I told him his PC had been used to access porn he looked genuinely shocked.
A quick look at the firewall log confirmed nothing dodgy had been accessed recently, and seeing as he didn't even know a firewall log existed, let alone how to alter it, that's good enough for me..
Anyway, he told me that he had let his teenage nephew use the PC when he came to stay some time ago.
A quick look at the index.dat files confirmed they had not been tampered with, and I was able to provide him with a list of very dodgy porn sites, together with an estimate of what date they were accessed.
For basic analysis, you don't actually need any tools - just open a DOS window/command prompt, CD yourself to the appropriate location, and use good old fashioned EDIT to view and search the index.dat file.
I offered to delete the index.dat files, but he declined, saying he wanted to keep the evidence to confront his nephew with.
EDIT: As an aside, the reason booting in safe mode works, is that the index.dat files are no longer locked by Windows, as it doesn't use them in this mode :p If you use a normal boot you cannot delete them using Spybot shredder or anything else, although of course you can set up something that runs when you reboot, which is not quite the same thing ....
:)
Thanx for the info darkes,
this thread has become highly instructional for me, as it illustrates the various methods of accessing files and being able to read the information contained therein. Also, the use of the CLI may be a lost art, but I find it really enhances the computing experience. I have this 'DOS for dummies', makes for a great bedtime read.
It just gets me all excited, yesssss, my precioussss.......
All,
This has indeed become quite the informative thread. Although I didn't start the thread, thanks to everyone for your input!
I'll be cuttin' & pasting a bunch after I steal his little precioussss.......and toss that bugger into the fire!
cheers
As a final point on this thread, I think there is an important moral/legal issue here.
If you want to use your own PC to access hard core porn, that is fine, and do anything you like to clean up afterwards ;)
However, when you are using a PC that belongs to someone else, who has explicitly asked you not to do anything like that, then that is not acceptable in my view.
Even worse, when I said dodgy, I meant probably illegal under UK law.
legalities,schmegalities lol,jk..one final point well,two actually
One:index.dat logs only http entries right?does windows have any other 'secret' files that log other types of connections?
Two:When I opened my index.dat file(it said excel,so I tried that first),it showed most entries as code...my question is...why most entries and not all of them?
Thanks for all the input guys and weee..I actually asked a sane question;)