Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose that a user uses inprivate mode in Internet Explorer and browsed something.

Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having to search network log file.

How can I recover the history from the user's PC?

Edit: I would like to know the window he closed at the last moment.

share|improve this question
In principle you may be able to get information from a dump of the RAM; but really its much simpler (and more likely to be successful) to just read a network log file. – dr jimbob Jun 15 '12 at 3:51

The whole point of the private modes that modern browsers have is to make this difficult, by removing temporary cached files, leaving no history and not storing cookies.

As @drjimbob says, your best bet is probably going to be to dump RAM if you don't have access to any of the network logs.

share|improve this answer
Also proxy logs if you use a proxy. – Bernie White Jun 15 '12 at 21:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.