Understanding Index.dat (Internet History Data File in Windows)

by Bhushan Shah, NII Consulting

The index.dat is a file which contains the list of the websites that one has visited. It comes from “indexing” which is used to speed up query responses.

The autocomplete feature in Internet Explorer compares the addresses to the index.dat to find an appropriate match. The size and life of the index.dat depends on the user and the options under: – Internet Explorer: Tools> Internet Options (Days to keep pages in history).

There are three kinds of index.dat files.

  1. Daily
  2. Weekly
  3. Master

1. Daily index.dat:-

This file contains the data of one visiting websites for the day.

This index.dat file can be found in C:Documents and Settings*profile*Local SettingsHistoryHistory.IE5*folder*

The folders name information is given below:-

MSHist012006081020060811

MSHist01 is common for all folders.

Next comes “from” date – 20060810 i.e. 2006/08/10 (yyyy/mm/dd)

Lastly comes the “to” date – 20060811 i.e. 2006/08/11 (yyyy/mm/dd)

2. Weekly index.dat:-

This file contains the history of the user for the week.

This index.dat file can be found in C:Documents and Settings*profile*Local SettingsHistoryHistory.IE5*folder*

The folders name information is given below:-

MSHist012006073120060807

MSHist01
is common for all folders.

Next comes “from” date – 20060731 i.e. 2006/07/31 (yyyy/mm/dd)

Lastly comes the “to” date – 20060807 i.e. 2006/08/07 (yyyy/mm/dd)

3. Master index.dat

This file is located in C:Documents and Settings*profile*Local SettingsHistoryHistory.IE5 i.e. the root of History.IE5

Index.dat Viewing Utilities:-


There are a few utilities on the WWW to analyze index.dat. They help in organizing the data from it in an easy to view and customable manner. Here is a list of a few such tools:-

Deleting index.dat:-

This file is “locked” by the operating system, which means that one cannot delete it with the normal “Del” command.

Note: Once it is very big in size it can start affecting the browser performance.

There are a few tools online available to delete this file but the easiest way I found to delete this file is to replace it with another file. I.e. Make a new text file, name it as index.dat and save it. Now, for every index.dat there is replace it with the file that you made i.e. the empty index.dat.

Alternatively, you could use tools like Unlocker. This is a very nice free tool to view which applications are sharing the file and also to kill or unlock those applications so as to delete or modify it.

  •  
  •  
  •  
  •  
  •  
  •  
  •  

5 Comments

  1. Yes, Index.dat Suite is really excellent at what it does – and the author recently added “Delete Prefetch folder contents” to it.

    It’s both an excellent “examination”-type tool AND an excellent “anti-forensic” tool – just depends on how it’s used. Pete

Comments are closed.