Tracking websites your child has visited - he deleted history

[RamboLiberal]

One of our parents at my office asked me this. Anyone know of a way?

My son cleared the website history list while I was away last week.

I have a strong suspicion that he was viewing websites he shouldn’t have been in.

Is there any place on my computer that I can still get to it even though it was deleted?

[bemildred]

1. Google "Windows Hidden History File"

But, I dunno if I'd get involved.

[Longhorn]

2. My son was told he would lose computer priveleges

if he deleted the history. We bought the computer and paid for the internet access so he had to follow our rules.

[Berserker]

3. You did not say what OS

you are using or if you are using IE as your browser. But you can go to C:\windows and check the history folder and also check the temp folder you may find some things this way.

http://www.pctools.com/privacy-guardian/insight/view/delete-history/
you can't delete history effectively with your browser open. And that's not all! When you select delete history, what's deleted isn't the actual file information! That is still left on your hard drive for all to see. What you actually deleted was just the file's directory entry!

In effect, all of the sites you've surfed, pictures you've viewed, and chat rooms you entered are still on your computer ? all you do when you select delete history is label them as empty space. Eventually, the hard drive on your computer will recycle this space, but the larger your drive, the longer it takes.

[charlie]

4. Internet Explorer?

If that's the browser, yeah he can, but it's a bit of work. When you clear IE's history (or temporary internet files, or cookies), it removes the shortcuts, but doesn't delete the index (index.dat).

On WinXP, that file can be found here:

C:\Documents and Settings\<user name>\Local Settings\History\History.IE5\index.dat

Win9x:

C:\Windows\History\History.IE5\index.dat

Windows Explorer won't display that file or the History.IE5 folder though, so he'll have to access it from the command line (Start --> Run --> cmd) and copy it somewhere else on his drive. Then he'll need something to view it. A plain text editor will do in a pinch, since the URLs are embedded in ASCII format.

But it'll be a long night's work. Since the file is never deleted, it'll be huuuuge.

Or he can ignore the bits about copying and moving, and try using this program for perusing index.dat files instead:

http://www.exits.ro/index-dat-viewer.html

Can't vouch for it though, I've never used it.

[RamboLiberal]

5. Op system and Browser

He didn't tell me - knowing our employees, probably XP and IE.

Thanks for the help.

[Jersey Devil]

6. Several programs clean the index.dat files automatically

She didn't say, but Norton Systemworks Cleanup will erase the history and index.dat files completely as will Webroot's Window Washer so if Systemworks is installed she should disable it for her son's username and then look for webroot and window washer in the program files and if there uninstall it. Then there are several other things she can do if she is using XP like take away her son's internet options in IE and his privileges to install or uninstall programs at all on the computer.

One other thing. It is possible he doesn't even use IE which would account for there being no history so she should check to see if other browsers such as Firefox have been installed.

[McKenzie]

7. there are third party utilities that will recover "deleted" files

Windows doesn't erase files using the delete command; it just marks the space occupied by the file as unused and available for over-write. The "deleted" file is perfectly recoverable until it gets over-written at least once. Even at one over-write it's recoverable depending on what it's been over-written with.

Try this to get deleted file names back. The full version is needed to recover the files themselves.

http://www.filerecover.com/