Recovering deleted browsing history, tips?

[saracrow]

I have an employee that in the past has abused his work notebook. He brought it in with viruses that ground it to a halt. I had used a program called Recovera at one point and found a bunch of adult websites, local hookup stuff, ect. on the computer.

He thinks he is crafty and deletes the history before bringing it to me. Well this is the third time this year, after the last one I specifically stated to everyone in the company "Deleting your browsing history is the same as surfing porn as far as I am concerned."

Well here we are at #3. His history has been deleted. I've just finished disinfecting his notebook with clorox wipes and I'm ready to see if I can clean this before i send it to our IT outsourced company. (I just do light IT work).

So I want to know, is there a way to go and restore his deleted history? Recovera was very broad and left me sifting through a ton of stuff last time. I've tried going into explorer > settings > browsing history > view files, but he deletes his cookies too.

[Omniyoji]

You didn't mention what OS he's running but if it's Windows, restoring to an earlier system restore point (if enabled) should IIRC restore browsing data. I'm not 100% sure tho, but that's one quick method.

[chiyio]

http://www.piriform.com/recuva Just tried it after deleting my firefox history. let me look at the files with a preview picture of what it was even.

[saracrow]

Thanks for the tips. Yeah it's Windows XP, and browing google recommends either restoring or using an index.dat reader.

[The Stig]

This reminds me of the early internet days of programs that will absolutely clear your index.dat and/or cache, or something. Either way I always thought it was just a scare/marketing thing (when they saying deleting your internet files/cookies aren't enough), but it seems 8 years down the line I am proven wrong, so it seems our (Windows) machines do absolutely keep a cache of all the sites you've visited?

I'll be interested to see what you end up with and if it really works.

[Norellicus]

You can also completely prevent any user from deleting their private data via group policy.

http://technet.microsoft.com/en-us/m.../dd349812.aspx