Apart from your temporary internet history folder, which is easily erased, all your online activity is recorded in a hidden index file, which is only accessable with specialist tools.
Index.dat files are hidden on your computer hard drive and contain tracks of all your online activity – where have you been on the internet, what sites you visited, list of URL-s, files and documents you recently accessed. The index.dat runs as long as a user is logged on in Windows and it’s role is to help speed up query responses.
The index.dat files cannot be deleted or erased easily, because they are always open when Windows is running. Open or “locked” files cannot be deleted in any way when the process using them is running. Even after the user has cleared the internet cache folder, there is no way to completely disable it, which means that the various index.dat files on Windows continue to store all the visited web addresses and cookies and some temporary files.
Removing single entries from index.dat files, through Windows Explorer, will only remove them from the visual display by Windows Explorer, not from the file itself until the next cleanup. While this can be seen a negative, marking single entries as deleted instead of erasing them is typical database behaviour and usually implemented to speed up removal operations, not to keep a backdoor to removed data.
Various tools will allow a user to view the contents of hidden index.dat files, thereby revealing all the internet activity.
For any forensic questions or data recovery issues, please contact us.
So not even removing cookie data from the pc helps to erase online activity? So Windows basically records that info as well on top of cookie and temp data?
“Deleting” cookie the conventional is easy, in order to do this properly, remember to close your browser first. This is because all your cookies are held in memory until you close your browser. So, if you delete the file with your browser open, it will make a new file when you close it, and your cookies will be back.
Although you think the data is gone, it can still be found with specialist forensic tools.
Very interesting, even with formatting hey? Probably why certain applications offer data erasing feature, but does that actually do the job to erase data, or will forensic tools still get that info?
The only way is to open the drive and physically destroy the platters, but this is my opinion.