Member Avatar for MissHalifax

We have a Dell Computer with Windows 7. The website history has been deleted and I am suspicious the reason is to hide a couple of sites that were visited. I am NOT computer smart and I really need some help with this. Is there a way for me to search for a specific website that may have been visited when the history has been deleted? Is it also possible to tell how many times that particular website was visited and the dates of each visit? Now, I'm going to reach for the moon and ask if it is also possible to see how much time was spent in each visit?

  • 2 Contributors
  • 1 Reply
  • 1K Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by Member #1091071

Dani AI

Generated

A short expert note building on and : recovering deleted browser history is often possible but not guaranteed. The single most important step is to preserve the disk state and avoid any further writes (do not run cleaners, avoid browsing or installing recovery tools). A forensically sound full-disk image created with write‑blocking hardware — or hand the machine to a qualified examiner — is the right way to preserve evidence and keep options open (live memory capture may also be needed in some cases). SWGDE — Best Practices for Computer Forensic Acquisitions. (swgde.org)

Useful sources beyond the browser's deleted file itself include cloud sync copies (for example, Google My Activity when Chrome is signed in, or Firefox Sync), router/gateway or proxy logs, and server-side logs for the website in question. On Windows there are many system artifacts (MFT, thumbcache, prefetch, Amcache, WebCacheV01.dat, event logs, pagefile) and the browser profile databases that forensic tools parse for visit timestamps and visit counts. See Google and Mozilla account/activity docs and common forensic parsers/schema documentation. . Firefox Sync info. Plaso / history DB schemas (shows timestamps/visit_count fields). Common Windows/Browser artifact list (forensic reference). ()

Expectation management: URLs and visit timestamps—and frequently a visit count—can often be recovered if artifacts remain unoverwritten. Precise “time spent on page” is not reliably recorded by local history; that metric is usually estimated by analytics or available from server/proxy logs. If the matter is serious (legal, safety, or disciplinary), preservation and analysis by a qualified digital‑forensics lab or law enforcement is strongly recommended. (plaso.readthedocs.io)

Member Avatar for Member #1091071

There are several ways to check websites have been visited in the past, although I have to make it clear that it will be extremely difficult, almost impossible, to check with your requested level of detail. I'll do my best to help though ;)

There are two ways to recover these details (that I am aware of):

  • through the computer's DNS cache
  • through recovering the browser's deleted history file.

You may wish to do both of these.

~~~~~~~~~~~~~

DNS Cache method: (I would recommend this)

Pretty much the most reliable way to check a computer's internet history is to check your computer's DNS cache - it's a quick-access store for the ip addresses of previously visited websites, which is browser independant, and it isn't cleared very often.

You'll get a list of websites and their ip addresses (although the web address will only be useful to you)

This is a very helpful tutorial on how to do this: http://www.wikihow.com/Display-the-Contents-of-Your-DNS-Cache

The obvious drawback of this is the fact that you'll not be given much info on how often or when the websites are visited, and it's a very large list that you'll have to go through yourself.

~~~~~~~~~~~~~~~~~~~

Browser history recovery method:

This method is a shot in the dark. To "reach for the moon", as you put it.

When a peice of data is deleted from a hard drive it is not deleted as such. The area on the disk where the "deleted data" is simply marked "empty", to be written over later on by some other program. It's entirely possible to recover this data, although it may or may not have already been written over.

This method also requires some research on the browser in question, as different web browsers have different ways of storing, and clearing their history.

You'll have to find the name of the browser in question, and research where the history is stored.

If the browser in question simply stores it in a file, you may be able to recover it using this tool (free) http://www.piriform.com/recuva , if it hasn't already been overwritten.

Depending on the browser, it may be difficult to achieve this.
Google Chrome for example, uses multiple files and a file format called 'sql' to store it's history. Even if you could recover the files, it's quite difficult to read them. You'll likely have to seek a specialist firm if this is the case.

~~~~~~~~~~

Best of luck!

~ Alex

Edited by Member #1091071
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.