94 posts in this topic
Create an account or sign in to comment
You need to be a member in order to leave a comment
-
Similar Content
-
By Graywalker
The goal here is to get the Internet History for endpoints and users in the enterprise to find what business use websites use Java.
When opening index.dat in Notepad, I can see all the data I need. Unfortunatly, trying to read that data in AutoIT is proving diffucult.
I've tried :
Func _ParseIndexdat($indexdatpath) ; Parse index.dat file for useable info ; The tools I've seen don't grab all the info I want :( $Bindexdat = FileOpen($indexdatpath,16) $indexdat = FileRead($Bindexdat) $strIndexdat = BinaryToString($indexdat,2) MsgBox(0,"String from Binary",$strIndexdat) $FileArray = StringSplit($strIndexdat,@CRLF) ;This may get complex... Dim $r = 1 ; to count the records Dim $e = 0; to count the entries ; Start reading from line 1 For $line In $FileArray $content = StringStripWS($line,7) Select Case StringInStr($line,"REDR") ; this is the start of a record MsgBox(0,"REDR",$content) Case StringInStr($line,"URL") ; this may be the start of a record MsgBox(0,"URL",$content) Case StringInStr($line,"LEAK") ; this is the start of an error record ; I will likely ignore it. MsgBox(0,"LEAK",$content) Case StringInStr($line,"http://") ; this is the line with a couple entries MsgBox(0,"http",$content) Case StringInStr($line,"Content-Type:") ; this is an entry I want MsgBox(0,"Content-Type",$content) Case StringInStr($line,"X-Powered-By:") ; this is an entry I want MsgBox(0,"Powered-By",$content) Case StringInStr($line,"~U:") ; this is an entry I want and it marks the end of a record MsgBox(0,"~U",$content) Case Else ; do nothing with the line EndSelect Next EndFunc
That doesn't get the info... That code doesn't return anything.
Using
$Bindexdat = FileOpen($indexdatpath,16) $indexdat = FileRead($Bindexdat) $strIndexdat = BinaryToString($indexdat,1) MsgBox(0,"String from Binary",$strIndexdat)
the "string from binary" msg box shows a LOT of data... but URL and http case are both blank or gibberish. BinaryToString($indexdat,2) and ,3 return Nothing in the cases - 4 does the same as 1.
Using :
$Bindexdat = FileOpen($indexdatpath, 16) $indexdat = FileRead($Bindexdat);$indexdatpath) MsgBox(0,"Index dat",$indexdat) $strIndexdat = BinaryToString($indexdat,1) MsgBox(0,"String from Binary",$indexdat);$strIndexdat & @CRLF & @error) $FileArray = StringSplit($strIndexdat,@CRLF)
Shows that $indexdat and $strIndexdat are effectively the same.
Using :
; Parse index.dat file for useable info ; The tools I've seen don't grab all the info I want :( ;$Bindexdat = FileOpen($indexdatpath,16) $indexdat = FileRead($indexdatpath);$Bindexdat) ;$strIndexdat = BinaryToString($indexdat,4) MsgBox(0,"String from Binary",$indexdat);$strIndexdat & @CRLF & @error) $FileArray = StringSplit($indexdat,@CRLF)
It reads a lot more info... Content-Type is fine. ~U: is fine. URL is mostly blank.
Case http:// it will pop up the msg box, but $content is blank. So the data is there... I just can't figure out how to get it into a string.
Using :
$Bindexdat = FileOpen($indexdatpath,256) $indexdat = FileRead($Bindexdat);$indexdatpath) MsgBox(0,"Index dat",$indexdat) $strIndexdat = BinaryToString($indexdat,1) MsgBox(0,"String from Binary",$indexdat);$strIndexdat & @CRLF & @error) $FileArray = StringSplit($strIndexdat,@CRLF) Returns data, but URL and Http:// pop up as blank...
$Bindexdat = FileOpen($indexdatpath,48) - URL and Http are blank.
I've found a VBScript that is supposed to read the files... so far no luck on Win7 - it can't find index.dat file... lol! On remote XP machines, it can't find a history folder. So I don't know if it DOES read index.dat files.
I've attached it.
Any ideas or code help is greatly appreciated!!
IE_Network - Copy.txt
-