Too much sadness old windows has been forgotten by users. Think this
intranet should help to buy new old editions just in case we need to surf
the web. The case is someone has been using this pc and now I can't
understand these changes, Time zone list for example. People like reliable
browsers.

"Paul" escreveu na mensagem ...

Trunch wrote:
Thanks for trying.


That (TypedURL) is one of the storage locations.

There are a couple others.

I see Good Guy has beat me to it. And the first
part of doing this, requires getting the menu
bar on there :-) Right-click the title bar
area, and tick the "Menu Bar" option. That
will give you the familiar words you see
at the top of this picture. I try to run my
browsers with the menu bar.

http://s31.postimg.org/aioqde5jv/history3.gif

*******

I did an analysis, to see how clean that method is.

My C: drive is 180GB. It has 40GB of files on
it. First, you don't want to have to search the
whole 180GB, for this sort of forensic work.

Using disk2vhd from sysinternals.com, you can
make a 40GB file from the contents of the 180GB
C: drive. This prevents the other 140GB of
old files and deleted content, from accidentally
triggering your forensic search.

The 40GB VHD file has only the actual files in it,
nothing else.

I loaded the 40GB VHD file onto the ram drive,
and used the HXD hex editor. I only downloaded
HXD Hex Editor for free recently, and it's a 64 bit
version with no size limit like my previous hex editor.
It can search the file at around 1GB per second,
or check the entire disk image in 40 seconds.
HXD also supports Unicode text strings, so
you won't be irritated by missing stuff because
of the text encoding used. Windows uses both
8 bit ASCII and 16 bit (wide) characters.

In addition to the Registry, I was also getting
a hit here. I think this is visited pages.

C:\Users\UserName\AppData\Local\Microsoft\Windows\ WebCache
WebCacheV01.dat (50MB)

Also, there is a history storage area. I got a hit on
the URL here (as well as the TypeURL registry thing).
Now, while you could visit here from Linux, Windows
doesn't let you navigate here. Because it has a
custom view, and presents the information as a
"logical" view.

C:\Users\UserName\AppData\Local\Microsoft\Windows\ History\History.IE5\MSHist012016042420160425

When you attempt to navigate there, Explorer renders that
as "Today". You need to have the File Explorer window set
to show system files, hidden files, file extensions, turn
all the jazz on, so you can get here. Otherwise you won't
even be able to get here for a look.

C:\Users\UserName\AppData\Local\Microsoft\Windows\ History
Today

Now, after the cleaning in the "history3.gif" in my
first link, the WebCacheV01.dat is smaller, but still
has a reference to the web site. So the file system
is not "minty fresh". The URL bar, yes, it no longer
digs up the URL on a match, but the file system itself
isn't really perfectly clean. Maybe with CCleaner, it
can be encourages to remove WebCacheV01.dat ?

Then, let's say CCleaner manages to remove the last
hit. On my example 180GB hard drive, now I have
verified that the 40GB of valid files is clean.
I have not checked the 140GB of unused file space,
which can have old versions of files. If you want
your OS partition to be "police department clean",
you'd need to overwrite the 140GB of white space.
Making an empty 140GB file will do that. I use
dd.exe for such purposes, as fsutil "cheats" and
is not suitable as a cleaning tool. The CreateFile
in fsutil is a sparse file, and no actual writes
happen (so it won't erase an NTFS volume for you).

So Good Guys method solves the URL bar problem.
How much further you go, depends on how clean
you need it.

Paul