Ask The Trades - Print Page

Ask The Trades
https://www.askthetrades.co.uk/cgi-bin/yabb/YaBB.pl DIY Forum >> Alarms, Phones, Aerials, CCTV & Datacomms >> PC Regstry https://www.askthetrades.co.uk/cgi-bin/yabb/YaBB.pl?num=1236531752 Message started by simonsays on Mar 8^th, 2009, 5:02pm

Title: PC Regstry
Post by simonsays on Mar 8^th, 2009, 5:02pm

Does anyone know how to look into a registry? I brought a second hand laptop for next to nothing and was wondering how to check what websites its been used to look at. The internet history and temp internet files are empty, but I thought you can look in the registry.

Or is there a better way?

Thanks
Simon

Title: Re: PC Regstry
Post by Lectrician on Mar 8^th, 2009, 5:14pm

The registry can be accessed by typing regedit into the run box under start menu.

It is unlikely to reveal anything of importance to you.

There are ways that real boffins can see what has been going on, but these are kept well and truly under wraps. Not even your run of the mill IT guys will have a clue.

Title: Re: PC Regstry
Post by CWatters on Mar 8^th, 2009, 8:46pm

Cookies and favorites are just files. Deleting a file does not normally remove it totally from the disk it just marks that space as unused so that it can be overwritten. It might be possible to use programs designed to recover deleted files to restore cookies and favorites. Try using one to looking for deleted files in places like..

C:\Documents and Settings\All Users\Documents\Favorites
and
C:\Documents and Settings\<user>\Favorites

You might have to be logged in as admin user.

You could also look for Index.dat files. These are system files and might be hidden. Don't just delete them. You can try opening one with notebook. Much of the content will be data but you might be able to find URLs in there mixed in. I could on my PC just now.

Index.dat files sometimes exist in places like...

C:\Windows\Cookies\index.dat
C:\Windows\History\index.dat
\Documents and Settings\[username]\Cookies\index.dat
\Documents and Settings\[username]\Local Settings\History\History.IE5\index.dat
\Documents and Settings\[username]\Local Settings\History\History.IE5\MSHist[digits]\index.dat \Documents and Settings\[username]\Local Settings\Temporary Internet Files\Content.IE5\index.dat

I believe some antivirus software also keeps a log of internet access.

Running system restore might also bring interesting stuff back from the dead but a bit drastic perhaps.

Second hand computers are a bit iffy. I'm sure there are many people out there who could easily write a program to harvest credit card details and email it back to them.

Title: Re: PC Regstry
Post by CWatters on Mar 8^th, 2009, 8:53pm

Just discovered some typed URLs might be stored in the registry at..

HKEY_USERS/Default/Software/Microsoft/Internet Explorer/TypedURLs/
HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/TypedURLs/

Be carefull what you edit in there.

Title: Re: PC Regstry
Post by CWatters on Mar 8^th, 2009, 9:06pm

Bit more googling found this program for opening index.dat files in a readable form. It's a command line program though.

http://www.foundstone.com/us/resources/proddesc/pasco.htm

Title: Re: PC Regstry
Post by simonsays on Mar 26^th, 2009, 10:30am

Thanks ffor all the information CWatters, I don't undersatnd how to use the Pasco programme though. Could you explain in laymans terms?

Many thanks

Title: Re: PC Regstry
Post by CWatters on Mar 27^th, 2009, 9:05am

If you aren't familiar with command line programs it might be best to try and find another program.

I've not used Pasco but it converts a .dat file into a .txt file that can be imported into excel or a similar spread sheet or even a word processor. The proceedure would be something like this..

Start -> run
and then type in...

<pasco> <inputfile> <outputfile>

but you don't type in that literally. You replace <pasco> with the full path to the location of the pasco program (eg: C:\Pasco\pasco or where ever you put it) and similarly for the input and output files.

Example

C:\Pasco\pasco C:\Documents and Settings\simon\My Documents\copyofindex.dat C:\Documents and Settings\simon\My Documents\index.txt

I recommend copying the .dat file to somewhere like My Documents before you experiment. It would be easy to accidentally overwrite the original file by mistake.

Edit: Now that I think about it I'm not sure the command line will accept spaces in the path names so may have to put " around them or put files in places where the path name doesn't contain spaces.