Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How to recover deleted web browsing history?


  • Please log in to reply
5 replies to this topic

#1 T_Dominici

T_Dominici

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 11 September 2009 - 08:50 PM

Preface: My operating system for my desktop computer is Microsoft Windows XP Professional Service Pack 2 and my internet browser is Mozilla Firefox version 3.0.13. My operating system for my laptop computer is Microsoft Windows XP Home Edition Service Pack 2 and my internet browser is Mozilla Firefox version 3.0.13.

Hello,

Is there any way that I can recover deleted web browsing history on my computer?

I was on a webpage a little over a week ago on either the 3rd or 4th of September which I now realize I really need to get back to. Unfortunately, I have no memory of what the address was and it appears that it's impossible to re-discover it via web search, as I've tried for several hours straight with no luck whatsoever. Even more unfortunately, when exiting Firefox a few days ago it asked me if I wanted to clear my browsing history, cache, cookies etc and I clicked "OK" without really thinking and now all the browsing history from before then is gone.

Now, the first thing I did when I realized my predicament was googling for help, and of all the sites out there giving answers on how to recover deleted web history, this one seems to be the most prominent and reliable:

www.wikihow.com/Recover-Deleted-History-in-Windows

This site says there are two ways to do it: a.) Using "System Restore" to go back to a time when the files were still there or b.) Using a program to read the index.dat files in the computer.

Since there are a lot of important documents and files on this computer and I haven't used System Restore before, I tried using it on an old laptop of mine first to see what the results would be. Before I did, I checked the current web history on the laptop; it spanned about 5 days, from September 5th to September 10th. (I did this yesterday on September 10th). I restored it to the date of August 19th (2009) and after loading for a while it booted up with a desktop full of items and folders that I had deleted since August 19th, which was encouraging, but when I opened up Firefox and checked History, it was exactly the same as it had been before doing the System Restore, with the history still showing the same web addresses from September 5th through September 10th instead of showing the addresses I had visited on August 19th and prior. I'm not sure if there's some other way I should be viewing the history other than just going to the System Restore point, opening Firefox in the restored date, and selecting History - Show All History, but apparently the result of doing this yields the same History results as it does before the System Restore is put into place. Therefore I didn't feel it necessary to try this on my regular computer since it apparently doesn't work in giving you your history from the date you restored to and also since doing a System Restore on my laptop led to a whole new set of problems for that computer; read my thread about THAT here.

So, unless anyone can provide insight as to how else System Restore can be used effectively to retrieve deleted Web Browsing History, it looks like that option is out.

Now the second thing that the wikihow page suggests to do is to download a program that will read the index.dat files in the computer and give you various histories. It says "Super WinSpy is one such reader, but it's infected." The fact that they say "it's infected" right after providing a link to download it seems a little odd to me and leads me to believe that it's not something I want to download or install on my computer. I googled Super WinSpy and found some pretty mixed results, many of which said it should be avoided at all costs and some of which looked rather sketchy. It then says to do a google search for "index.dat reader," which I did, also to sketchy and mixed results, so at this point I decided I'd better check here first where there are actual computer experts who can let me know what to do. Lastly, going the index.dat route, I did some research on index.dat files and it would appear that they only work with Internet Explorer, a browser that I never use, and the URL I need was viewed in Firefox, not IE.

So that brings me to where I am now. Sorry if this post is a little lengthy, I wanted to try and include all the details.

Can anyone help with this in any way?

Thanks in advance for any responses,

-T

Edited by T_Dominici, 11 September 2009 - 08:54 PM.


BC AdBot (Login to Remove)

 


#2 Romeo29

Romeo29

    Learning To Bleep


  • BC Advisor
  • 3,165 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:07:00 AM

Posted 14 September 2009 - 09:50 PM

Hi T_Dominici,

The file index.dat is associated with Internet Explorer's history and recovering it or reading it, will not help you in any way to recover Firefox's history.

Your chances of recovering FF(Firefox)'s history increase more if you have used FF very less or not at all after clearing your history. The reason is overwriting of files and records by FF. So try not to use FF if you want to recover its history.

System Restore works depending on what kind of data its backing up when it is creating a Restore point. So if you make a restore point immediately before clearing your history then it would work. If you cleared history sometime after or sometime before creating a restore point, then your chances reduce.

There is a tool, used for forensic analysis called Firefox 3 History Recovery or FF3HR in short. It can be used to recover FF3 history to a certain degree of success. The problem is that you would have to create a disk image of your system to use it. You can create a disk image using WinHex or FTK Imager. Then give the command :
ff3hr -i [i][diskimage][/i]

FF3HR : http://sourceforge.net/projects/ff3hr/
WinHex : http://www.winhex.com/winhex/
FTK Imager : http://www.accessdata.com/downloads/curren...ite%202.6.1.zip

As I said, this tool is for forensic analysis and not for everyone's use. Use it if you are really desperate for finding your browsing history.

Have a nice day :thumbsup:

#3 T_Dominici

T_Dominici
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 15 September 2009 - 01:40 PM

OP here,

The more I think about it, the more I think I may have viewed the URL I need in Internet Explorer that day after all. I'm still not 100% sure that I did, but at the very least I think I viewed other pages that could lead me back to the one I need. Plus, I figure I should go the index.dat route first just in case it works, since it seems far easier than the disk image thing.

So what exactly do I need to do to try and recover my IE history from about 2 weeks ago? Is there a confirmed safe program that will read the index.dat files, or another method of doing so that's proven safe and effective?

Thanks again for all help,

-T

#4 T_Dominici

T_Dominici
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 15 September 2009 - 05:56 PM

OP here again

Miraculously I rediscovered the web URL I needed after doing some more hunting with Google, so it turns out that I don't need to delve into recovering the deleted history after all, which is a big relief. You can feel free to close or move this thread now. However, the other issue that I made a thread about (my laptop being stuck in a past System Restore date and not allowing me to return to the present date) is still very much a problem and any help related to that would be much appreciated. Here's the link:

http://www.bleepingcomputer.com/forums/t/256978/cant-come-back-to-present-day-after-doing-system-restore-to-a-month-ago/

Thanks!

#5 Rayvn

Rayvn

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Illinois
  • Local time:07:00 AM

Posted 26 March 2011 - 05:13 AM

Firefox history is stored in places.sqlite or history.dat within the Firefox profile folder. Use a file recovery program to find that file from the correct date. It will have to be a program that uses "deep scan" to find files that were overwritten directly rather then manually deleted.

To restore your laptop, go back into System Restore and "undo last restore".

Can somebody please tell me why this user believes you have to make a disk image in order to use the FF history recovery program? Is this just copying the C drive to an ISO or what?

#6 trizicus

trizicus

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:00 AM

Posted 27 March 2011 - 10:57 PM

There is a way, but requires some technical ability. Some tools to recover deleted data from any kind of disk media are:

Scalpel
PhotoRec
Recuva
DiskDigger




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users