Recent Activity Question

[jerick70]

Hello,

I have a questions about OSForensics Recent Activity Browser History report. There are entries that have "file:///path to file" in the object and URL columns. These entries are from Internet Explorer and are the exact same. What is this representing exactly?

-Jeff

[Richard (PassMark)]

The Item column would contain the webpage title, however, sometimes this information is not available and in such cases, the URL is used.

[jerick70]

So these entries mean that these were uploaded or downloaded to a website? Am I correct on this? Also could the files that are represented here have been opened in Outlook?

[Richard (PassMark)]

So these entries mean that these were uploaded or downloaded to a website? Am I correct on this?

Not necessarily. The entries for Browser History for Internet Explorer (IE 5-9) come from an index.dat file (WebCacheV01.dat for IE10+). This file contains information such as web URLs, search queries and recently opened files. Entries with "file:///..." means that the file was located/saved on the computer when it was opened with an Internet Explorer "Viewer", e.g. PDF file set to open in IE. The index database file can be possibly shared with other programs that might open a webpage using IE back-end within the software, e.g. Outlook,

[jerick70]

Not necessarily. The entries for Browser History for Internet Explorer (IE 5-9) come from an index.dat file (WebCacheV01.dat for IE10+). This file contains information such as web URLs, search queries and recently opened files. Entries with "file:///..." means that the file was located/saved on the computer when it was opened with an Internet Explorer "Viewer", e.g. PDF file set to open in IE. The index database file can be possibly shared with other programs that might open a webpage using IE back-end within the software, e.g. Outlook,

Richard, thank you for the assistance on this.