WHERE HAVE YOU BEEN TO YESTERDAY?

by Brian Grainger: brian@grainger1.freeserve.co.uk

I suspect all us computer junkies had a quiet smirk when Gary Glitter was arrested last year. He took his PC to be repaired but he left on it images that it was illegal to possess. They were found by the repairer, the whistle was blown and Paul Gadd was duly arrested. How stupid we all thought. (Incidentally does anyone know what happened to him?)

OK wise guys, do you know how the trail of where you have been to on the Internet is kept on the PC? More importantly, do you know how it can be erased? It was when I asked myself these questions, and tried to answer them, that I discovered I did not know how Internet Explorer (IE) works. For users of Navigator it is dead easy to remove traces of where you have been. The bookmarks are in a file called bookmark.htm. The cookies are in a file called cookies.txt. The log of where you have been is in a file called netscape.hst. All three files are in the netscape directory. Delete them and your visits to those naughty sites will remain unknown to the outside world. Things are a whole lot more complicated with IE and if all you have is the basic Windows 95 you will be kept pretty much in the dark.

To see the extent of the problem I urge you to fire up WINDOWS Explorer (WE) in 'Details' view (select Details from the View menu) and have a look at the following folders:

\windows\cookies
\windows\history
\windows\temporary internet files

Now fire up the old File Manager. Do this by clicking Run from the Start Button. Browse in the \windows folder for winfile and start it up. From the View menu select By File Type and click on Show hidden/system files. Using this you can now see how things are really stored on your hard disk. Have a look at the same 3 directories above. Because File Manager cannot resolve file names longer than 8 characters 'temporary internet files' will be found as tempor~1.

The \windows\cookies folder does not look much different. It consists of lots of little text files, the cookies themselves, and at least 1 other file. This file is called index.dat which is an index to the cookie files.

The \windows\history folder looks a little different in File Manager (FM). In WE it is very much like clicking the History button in IE. With FM you will see the index.dat, plus possibly some sub-directories, each if which contains another index.dat file.

The most interesting of the lot is the temporary internet files folder. With WE you will see in that folder or any of its sub-folders a list of various files plus references to the cookies again. Also the information it gives is quite different from a normal folder. It gives the internet address plus details of when it was accessed and so on. This folder looks quite different in FM. Again at the top level you see the index.dat file. However each of the sub-directories hold different files.

These 3 folders plus your favourites hold the keys to where you have been and probably the cookies are the easiest to see incriminating evidence! You will be amazed at how many cookie files you have got. Virtually every site you visit sends a cookie! Using WE the names of the cookie files are usually self explanatory so if you see one labelled john_s@world_of_sex you feel that John Smith has been up to no good! However, while easy to clear, the history folder could possibly hold incriminating evidence and the temporary internet files must NOT be forgotten for the reasons given below. I shall now look at these 3 folders in detail. I shall present my thoughts on the basis of some trial and error tests I have run. I did try to gain information from the help files and even had a look at the book called Inside Windows 95 Secrets, which says more than most books on the subject of Windows 95. No books would tell me about how these folders and files were used or how to delete things in the proper manner.

The cookies folder is straightforward. Each of the text files is a cookie. If you open one in Notepad you will probably see some text that makes sense and a lot of numbers that do not. The index.dat file is, not unexpectedly, an index file to the cookies. If you try and open it with Wordpad you will find you get a message saying the file is in use. What is using it you may well ask. In any event it may suggest it is fairly safe from prying eyes. You will get the same message if you try and open the index files from the history or Temporary Internet Files folder. I would seem that the Windows 95 operating system opens all these files and uses them for its purposes. However you can see their contents if you have a dual boot machine or reboot the machine into MSDOS mode and have a good DOS mode file viewer available. I have a dual boot machine so reboot into Windows 3.1 and use Write. This shows the index file as having references to the individual cookie file names separated by non-ASCII translatable code. I have said above that cookie file names can be incriminating so how does one get rid of cookies. I could find nothing which told me how to do this. All the books tell you how to avoid accepting cookies in the first place, which will probably make traversing the web extremely tedious, but nothing tells you how to delete them once they are on your machine. Deletion of cookies is extremely tedious as well. Here is the process to follow.

1. Start IE
2. From the View Menu select Internet Options
3. Click the Settings button within the Temporary Internet Files area of the dialog
4. Click the View Files button
5. Select the cookie files you want to delete from the list of files. You can do them one at a time or in blocks.
6. From the File menu select Delete. For each cookie file that you have selected you will be asked to confirm deletion. This is why cookie deletion is tedious!
7. Click OK enough times to return back to IE.
8. Close IE and reboot the PC! The cookie deletions do not take effect until the PC is rebooted.

When you have followed the above procedure you will find the index.dat file has now had the cookie entries removed. However the cookie files themselves are still there! You have to delete them manually, (you remember their names don't you?), using WE.

I cannot believe removing cookies is so awkward. I have not tried deleting the entire contents of the cookie directory. I suspect this may work but I did not do this because I wanted to keep some cookies, such as my quick access to the Microsoft Advanced Search facility. If anyone knows of an easier way to delete cookies please let me know - no wisecracks about eating them either!

Now let's turn our attention to the history folder. The index.dat files contain references to where you have been so www.world_of_sex.com may be lurking. It also contains references to the off-line files you have viewed, any channel stuff that is accessed, any stuff accessed using Front Page Express and who knows what else that I have not discovered yet. Getting rid of the URL references is simple. Follow this procedure.

1. Start IE
2. From the View Menu select Internet Options
3. Click the Clear History button within the History area of the dialog
4. Click OK

Unfortunately this still leaves the references to the off-line files viewed and all the other stuff so if you have predilections similar to Gary Glitter this could be highly embarrassing. There is only one solution - delete the index.dat files. However, you cannot see these files with WE! Now you can see how easily Joe Public could leave incriminating information on his PC. The simplest solution is to delete the \windows\history folder using WE. A new one will be created next time you start IE.

Finally we turn to the temporary Internet files. This is very similar to history in that it appears very simple to remove. Follow this procedure.

1. Start IE
2. From the View Menu select Internet Options
3. Click the Delete Files button within the Temporary Internet Files area of the dialog
4. Click OK

However, after doing this the index.dat file will still contain references to:

any sub-directories used for temporary files (usually 4)
channel cdfs
where cgi scripts have been used
where search pages have been filled in

The last two items may be incriminating. Again the only solution to getting rid of this is to delete the index.dat files. Again with WE you cannot see them so the simplest solution is to delete the \windows\temporary internet files folder. Deleting these index.dat files has another benefit. They keep increasing in size. Even if you Delete Files the file references get overwritten with blank information but the file does not grow any smaller. Deleting the files returns some hard disk space to you.

In order to complete the task don't forget to delete any favourites that you have bookmarked. That's it. As far as I know that will remove all references to where you have been to yesterday. Apart from providing the procedures for you to follow I hope that this discussion has made you more aware of how easily your privacy is being compromised these days. Two cases have been well publicised recently. The inclusion of a serial number within the Pentium III chip. The inclusion of machine specific code within Word 97 documents that identify from where the document originates. Fixes for both these features were issued when the public found out and objected. It is what we do not find out that is the problem!

Journal Contents