Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Suppose that a user uses inprivate mode in Internet Explorer and browsed something.

Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having to search network log file.

How can I recover the history from the user's PC?

Edit: I would like to know the window he closed at the last moment.

share|improve this question
1  
In principle you may be able to get information from a dump of the RAM; but really its much simpler (and more likely to be successful) to just read a network log file. – dr jimbob Jun 15 '12 at 3:51

1 Answer

up vote 2 down vote

The whole point of the private modes that modern browsers have is to make this difficult, by removing temporary cached files, leaving no history and not storing cookies.

As @drjimbob says, your best bet is probably going to be to dump RAM if you don't have access to any of the network logs.

share|improve this answer
Also proxy logs if you use a proxy. – Bernie White Jun 15 '12 at 21:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.