IE Cookies/Cache Cleared

[JLogan3o13]

I am researching an issue for a customer, thought I would throw it out there in case anyone has ever run into this. The customer has two employees in her office, one of them cleared cache and cookies in IE (something she relies on heavily). Both employees state it was not them; she wants to find out who is being dishonest. She is looking to determine the exact date/time this was done. I am looking at Event Logs, but don't believe they record that action. Also, I know I can clear it all through WMI, but do not see any way to report one when it was last done. Just curious if any of you have ever encountered this, or have found a way (either through logs or programmatically) to determine when the cache/cookies were cleared.

[mLipok]

Did you try any tool like this:
https://www.krollontrack.com/products/data-recovery-software/

You should be able to check for lost files in specyfic directory:
http://www.thewindowsclub.com/cookies-folder-location-windows

As you do not need to restore them but only check creation/removal date, you should do what you need with free trial version.

EDIT:
And want to ask: did you chceck solution like this:

http://www.bullguard.com/blog/2014/08/5-ways-to-recover-deleted-internet-history-data-easily.html

http://www.wikihow.com/Recover-Deleted-History-in-Windows

 

Edited June 12, 2016 by mLipok

[JLogan3o13]

Thanks, I have seen most of those. It turns out the owner confronted the employee she suspected and got her to confess, so didn't need me to do anything more on this.