Temporary internet files forensics


















Even when the cache is set to zero percent, Internet Explorer requires a persistent cache for the current session. The persistent cache requires 4 MB or 1 percent of the logical drive size, whichever is greater. Disk Cache Storage Location. The disk cache location varies across operating systems and can usually be found in the following default locations:. Figure 1. Figure 2. Figure 3. To identify the correct location of the cache for each user, the registry hive for the particular user must be examined.

You cannot rely upon the live cache folder being in the default location. Figure 4 shows the registry key containing the cache folder location. Users have been known to move their cache location in an attempt to hide browsing activity. Figure 4. Temporary Internet Files Folder Structure. Within the Temporary Internet Files folder, you will find a Content. IE5 folder. This folder is the main disk cache for Internet Explorer.

Outlook Express also writes data to this location as is explained later in this article. Figure 5. DAT file is a database of cache entries.

It holds information relating to individual cached items so that the browser can check whether the resource needs to be updated eTag and information relating to the location of the cached item.

Figure 6. Cache File Naming Convention. As files are saved to the cache, Internet Explorer uses a specific naming convention as shown in Figure 7.

The only exception to this rule is when data is written to this location by Outlook Express. Figure 7. As pages and resources are cached, they can easily end up in different folders. Internet Explorer attempts to keep the volume of data and number of cached items across each cache folder as level as possible. As Internet Explorer writes files to the cache folders, it checks to see if a file with the same name already exists.

This is frequently the case when web developers do not use imaginative or descriptive names for their files. If the file already exists within the folder, Internet Explorer will increment the counter.

If no file exists, the counter portion of the file name is set to 1. Files with the same naming structure within a cache folder do not necessarily belong to the same web site. Also, multiple visits to the same web site can easily result in files with similar naming conventions being spread across all the cache folders.

DAT entry is not written to disk such as when Internet Explorer crashes before the entries are written. Figure 8 shows a typical cache folder. Figure 8. Outlook Express Email Client. If the user deletes their browser history Tools » Delete Browsing History the cache index is overwritten with zeros, and all response entities are deleted from disk. If the user closes an InPrivate Browsing session, every item in the cache which was stored during the InPrivate session is removed.

It is important to understand that what you see above is not exactly what is stored on disk—alert readers will observe that Explorer is showing columns, like Internet Address and Expires , that are not typically seen for other folders.

This is accomplished through the magic of a Shell Namespace Extension. As explained on MSDN: With a namespace extension, you can take any body of data and have Windows Explorer present it to the user as a virtual folder. When a user browses into this folder, your data is presented as a tree-structured hierarchy of folders and files, much like the rest of the Shell namespace. This folder is mapped to the Namespace Extension using the desktop.

The HTTP expiration information and similar columns is retrieved from the metadata stored in the index. Most importantly, this view does not show the Protected Mode cache; it only shows files that are downloaded outside of Protected Mode. This view may even show files that do not exist; if the backing response entity file was deleted from the disk without calling DeleteUrlCacheEntry to delete the index entry, the Namesspace Extension will still show the entry.

However, if WinINET ever wants to reuse the entry, it will find the file missing and will need to re-download from the server. You see the index.



0コメント