Internet explorer
Microsoft Internet Explorer (MSIE) is the default Web Browser included with Microsoft Windows.
MSIE 4 to 9
MSIE 4 to 9 uses the Internet Explorer History File Format (or MSIE 4-9 Cache File format). The Cache Files commonly named index.dat are used to store both cache and historical information.
MSIE 10
C:\Users\%USER%\AppData\Local\Microsoft\Windows\WebCache\
The WebCacheV01.dat and WebCacheV24.dat files are in the Extensible Storage Engine (ESE) Database File (EDB) format
Configuration
Internet Explorer will apply its setting in the following order, where the lower the order overrides settings in the higer order.
- Settings in Machine policy key
- Settings in User policy key
- Settings in User preference key
- Settings in Machine preference key
Machine policy key
HKET_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Machine preference key
HKET_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
User policy key
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
User preference key
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Security Zones
0 - My Computer
1 - Local Intranet Zone
2 - Trusted Sites Zone
3 - Internet Zone
4 - Restricted Sites Zone
5 - Custom
WPAD
TODO add some text
Command line options
MSIE supports various command line options, see: IE Command-Line Options
Artifacts
Recovery store
TODO add some text
On Windows Vista and later:
C:\Users\%USER%\AppData\Local\Microsoft\Internet Explorer\Recovery
Typed URLs
Internet Explorer stores the cached History (or Address box) entries in the following Windows Registry key:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
See Also
External Links
- Internet Explorer Cache
- Internet Explorer security zones registry entries for advanced users, by Microsoft
- Troubleshooting Automatic Detection, by Microsoft
- IE Command-Line Options, by Microsoft, January, 2011
- Little-known browser commands and functions, by Fred Langa, June 21, 2012
- Java Web Vulnerability Mitigation on Windows, by Tim Johnson, May 23, 2013
- Internet Explorer EPM Sandbox Escape CVE-2014-6350, by James Forshaw, December 1, 2014
Recovery store
- Internet Explorer RecoveryStore (aka Travelog) as evidence of Internet Browsing activity, by Yogesh Khatri, September 29, 2011
Typed URLS
- TypedURLs Registry Key, Sketchymoose's Blog, February 18, 2014
Internet Explorer 10
- Windows 8 Forensics: Internet History Cache, by Ethan Fleisher, August 21, 2012
- Forensic Analysis of ESE databases in Internet Explorer 10, by Bonnie Malmström & Philip Teveldal, June 2013