Index.dat, IE, and InPrivate?

So I'm sure most of us are familiar with Index.dat. But for those of you that aren't here is a quick summary. Internet Explorer stores a very heavily protected file in your user profile containing the URL, Date, and Time of every site you've ever visited. Deleting the History won't remove it and it is impossible to remove from within Windows (because it is locked in use like the kernel).

I've always assumed this was done to assist law enforcement. So the question is when InPrivate is running will IE continue to store the URL, Date, and Time of the site in the Index.dat file? And if the answer is yes doesn't that mean InPrivate is pointless?

As I understand it index.dat is tied to the Temporary Internet Files. Since the InPrivate stuff doesn't store files in the TIF, I would assume index.dat also isn't updated. That's just my reasoning though, not an official answer.

I can see where you're going here, and it is a perfectly apt question that I hope Charles, Dan and so forth should make representations to the IE team. No doubt some brilliant niner will ascertain sufficient information that proves or disproves whether private mode actually truely exists.

My feelings are that any company whether it be Microsoft or Apple is under obligation via the law institutions of the Nation, to ensure some level of control is put into place. I think the result will be "we will keep you private from everyone, except ourselves". With the Google Chrome browser, they will be following suit, and any other company (ISP providers being next in queue) that can get you to use their product.

vesuvius said:

I can see where you're going here, and it is a perfectly apt question that I hope Charles, Dan and so forth should make representations to the IE team. No doubt some brilliant niner will ascertain sufficient information that proves or disproves whether private mode actually truely exists.

My feelings are that any company whether it be Microsoft or Apple is under obligation via the law institutions of the Nation, to ensure some level of control is put into place. I think the result will be "we will keep you private from everyone, except ourselves". With the Google Chrome browser, they will be following suit, and any other company (ISP providers being next in queue) that can get you to use their product.

Which Nation would that be? Am I, as an Israeli citizen, bound to the laws of the US? Is Microsoft, which in addition to being an American company is also a registered company in Israel, bound to these laws in every product it provides all over the world?

And I don't think Google is keeping track of your browsing history in case National Security needs it.

If by heavilly protected you mean hidden, compressed, readonly, system and archive flags are set, then I'll concede your point. If you mean protected as in encrypted in any way, shape or form then you'd be wrong.

Yggdrasil said:

vesuvius said:

*snip*

Which Nation would that be? Am I, as an Israeli citizen, bound to the laws of the US? Is Microsoft, which in addition to being an American company is also a registered company in Israel, bound to these laws in every product it provides all over the world?

And I don't think Google is keeping track of your browsing history in case National Security needs it.

I watched the GNU/Video and that has some resonance, as the arguments against IE and Windows "sandboxing" or "blackboxing" segments of the OS simply are not there with GNU. All you need is an open source non recording web search facility.

Yesterday my heart sank when a priest was found guilty of child porn. The notable point was the offences were carried out between 1991 and 1997. I'm certain that this "blackboxing" of IE and the Kernel had a big part to do with his conviction, as well as his ISP.

This really begs the question, whether one can ever be truly autonomous on the internet, and whether it is Microsoft's obligation to ensure that a "record of activity" is maintained. The typical Government response is "if you have nothing to hide, there is nothing to worry about".

How do you strike a balance between ensuring communities are kept safe, and allowing people freedom with their data? The internet is an extension of self for most people now, and is open to good and mal-practice.

Yggdrasil said:

vesuvius said:

*snip*

Which Nation would that be? Am I, as an Israeli citizen, bound to the laws of the US? Is Microsoft, which in addition to being an American company is also a registered company in Israel, bound to these laws in every product it provides all over the world?

And I don't think Google is keeping track of your browsing history in case National Security needs it.

Yes. When installing Windows you agree to be bound by United States law (specifically Washington I think).

Heavily protected? Impossible to delete? Locked by the kernel? Oh my, I bet CIA added that file on our computers .

The kernel does not have anything to do with index.dat. The only reason why you cannot delete that file is because explorer.exe keeps it open. Stop/kill explorer and you can delete just as any other file. It's has the hidden/system attributes set but that doesn't mean anything.

Protected? It's not even encrypted, it's just a binary file and the URLs that are stored in it are visible in any hex editor.

And I don't have IE6/7 around to test but as far as I can see IE8 zeroes out index.dat when you clear history, which happens to be better than simply deleting it.

As for InPrivate: I haven't used it and I haven't payed too much attention to what it is but from what I know it is private with regards to what information (third party) sites can access. I have no idea what it means for files stored on the local harddisk as a result of browsing in a InPrivate session.

This may make interesting reading (granted it's mainly about IE7, not IE8 but no doubt a lot of it still holds true).

Dexter said:

Heavily protected? Impossible to delete? Locked by the kernel? Oh my, I bet CIA added that file on our computers .

The kernel does not have anything to do with index.dat. The only reason why you cannot delete that file is because explorer.exe keeps it open. Stop/kill explorer and you can delete just as any other file. It's has the hidden/system attributes set but that doesn't mean anything.

Protected? It's not even encrypted, it's just a binary file and the URLs that are stored in it are visible in any hex editor.

And I don't have IE6/7 around to test but as far as I can see IE8 zeroes out index.dat when you clear history, which happens to be better than simply deleting it.

As for InPrivate: I haven't used it and I haven't payed too much attention to what it is but from what I know it is private with regards to what information (third party) sites can access. I have no idea what it means for files stored on the local harddisk as a result of browsing in a InPrivate session.

You don't even need a hex editor. I can read my index.dat files just fine in notepad.

GoddersUK said:

Dexter said:

*snip*

You don't even need a hex editor. I can read my index.dat files just fine in notepad.

I know, but something tells me that it may be a bad idea to load a 2 megabyte file in notepad...

ManipUni, I have tried cleaning up all temp files, history, etc. (in IE 7) and the content of my index.dat files seems to be gone as it is explained in GoddersUK link. Are you saing it is impossible to delete the file content or the file content will not be deleted it you clear only your history?

I'm not quite sure what the conspiracy about Index.dat is about, I always understood that it was used to index the temporary folders in the temporary internet files, as temporary internet files is a special folder and made up a number of psuedo-randomly generated folder names in which content is stored.

As for in-private, if it were me I'd probably create the cached page with FILE_ATTRIBUTE_TEMPORARY so that once the page had been displayed it's just thrown away from memory and doesn't touch the disk, assuming that there is available space in-memory so it doesn't have to be paged out.

Oliver

GoddersUK said:

This may make interesting reading (granted it's mainly about IE7, not IE8 but no doubt a lot of it still holds true).

Hmm interesting link.

I've read before that was the design intent. But back in the day nothing you did could clear it including removing items which it is tracking.

Dexter: I said "like the kernel," not "by the kernel."

ManipUni said:

GoddersUK said:

*snip*

Hmm interesting link.

I've read before that was the design intent. But back in the day nothing you did could clear it including removing items which it is tracking.

Dexter: I said "like the kernel," not "by the kernel."

Umm, you're right. But you're wrong too . Unlike other executables (explorer.exe for example) the kernel (ntoskrnl.exe) is never locked "in use".

Dexter said:

ManipUni said:

*snip*

Umm, you're right. But you're wrong too . Unlike other executables (explorer.exe for example) the kernel (ntoskrnl.exe) is never locked "in use".

Sure it is.

Windows is just too polite to tell you. Go ahead and make as many changes as you like and see how long they "stick" for. My guess would be around ten seconds.

Back in the Windows 2Kish days you got a big nasty "That file is in use" error message or similar.

ManipUni said:

Dexter said:

*snip*

Sure it is.

Windows is just too polite to tell you. Go ahead and make as many changes as you like and see how long they "stick" for. My guess would be around ten seconds.

Back in the Windows 2Kish days you got a big nasty "That file is in use" error message or similar.

No it's not .

What happens is that Windows detects changes to system files and replaces any changed file with the "original" copy from C:\Windows\System32\dllcache and it does that for your own good (I actually saw at least one stupid installer/uninstaller that replaced ole32.dll with a Win95 version resulting in a blue screen after reboot). Now if you think you can take care of yourself and you don't need the OS to hold your hand you can always delete/change the file from dllcache.

All this applies to all dll/exe/sys files that ship with Windows (so the kernel is not a special case) and all this does not apply to user created (directly or indirectly like index.dat) files.