Interesting MS article

[Philip J. Koenig]

On 11 Apr 2002, at 20:19, by way of Douglas J Hunley boldly uttered: 

> Sorry for the URL I didn't make it up, but the read it quite interesting.
> I've not confirmed any of it, but it sure sounds like something Microsoft
> would do.
> 
> http://www.fuckmicrosoft.com/content/ms-hidden-files.shtml


[Warning: this is long]



Using Windows 2000, IE 5.5-SP2


Before clearing history, I searched for the described files.


1) None of the files were hidden, and even if they were, it would 
hardly be rocket science to search for them.  (I use 3rd party 
utilities for file mgmt because Windows Exploder is pretty worthless)

(I note that some *directories* were hidden, ie "Local Settings".  
But with a good file manager this isn't a big deal.)


2) They were all located in one of:
	c:\documents and settings\Default User
	c:\documents and settings\<local username>

	Since previous versions of Windows didn't use the "documents
	and settings" folder, it is logical that they would be saved
	wherever the rest of IE's local user data is saved under the
	convention used for that particular version of Windows - ie
	"c:\windows\profiles".

3) Subdirectories under the main dirs above where index.dat files
	were found included:

	\Cookies\index.dat
	\Local Settings\History\History.IE5\index.dat
	\Local Settings\History\History.IE5\MSHist01<date str>\index.dat
	\Local Settings\Temporary Internet Files\Content.IE5\index.dat
	
	("date str" is a string of chars that identifies the date of the
	history record, in a format like "01200204110020413" for April
	11, 2002 and presumably some timestamp)
 

I then cleared the cache and history from IE's tools menu, and 
searched again for the files.


1) All directories named with "date str" except the most recent
	one were deleted.

2) The following files were not touched, but had no obvious data
	in them anyway:

	\Default User\Cookies\index.dat
	\Default User\Local Settings\History\History.IE5\index.dat


3) The following files appear to have had all of their data
	cleared except a small fragment found in one file (a 400
	char long URL that may have just triggered a bug in the 
	clearing routine):

	\<local user>\Local Settings\History\History.IE5\index.dat
	\<local user>\Local Settings\Temporary Internet Files\Content.IE5\
		index.dat  (wrapped)

4) The following files were not touched, but did contain history
	data:

	\<local user>\Cookies\index.dat
	\<local user>\Local Settings\History\History.IE5\MSHist01<datestr>
		index.dat  (wrapped)



So to sum up, the only data remaining in these "hidden" files were:

A) Cookie data (IE doesn't claim to erase cookie data when clearing
	 the cache or history, neither do Netscape or Opera)

B) History for the very last IE session.


While item B is slightly annoying, and IE has plenty of other 
security problems, someone is putting their "Chicken Little" hat on a 
little bit early here.


Phil



--
Philip J. Koenig                                       pjklist at ekahuna.com
Electric Kahuna Systems -- Computers & Communications for the New Millenium