Suppose that a user uses inprivate mode in Internet Explorer and browsed something.

Now, an administrator wants to search the user's activity in Internet Explorer using the user's PC without having to search network log file.

How can I recover the history from the user's PC?

Edit: I would like to know the window he closed at the last moment.

  • 1
    In principle you may be able to get information from a dump of the RAM; but really its much simpler (and more likely to be successful) to just read a network log file. – dr jimbob Jun 15 '12 at 3:51

The whole point of the private modes that modern browsers have is to make this difficult, by removing temporary cached files, leaving no history and not storing cookies.

As @drjimbob says, your best bet is probably going to be to dump RAM if you don't have access to any of the network logs.

  • Also proxy logs if you use a proxy. – Bernie White Jun 15 '12 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.