IE 7-8-9 Browsing History

Overview

Evidence: IE 7 8 9 Browsing History Description: Collect Visited URLs from Internet Explorer Category: Browsing History Platform: Windows Short Name: ihst Is Parsed: Yes - index.dat files parsed using libmsiecf Sent to Investigation Hub: Yes Collect File(s): No

Background

Internet Explorer 7, 8, and 9 store browsing history in index.dat files using the MSIECF (Microsoft Internet Explorer Cache File) format. These files contain URLs visited, access timestamps, and visit counts.

Index.dat files are located in various user profile directories depending on Windows version (XP vs Vista+).

Data Collected

Field	Description	Example
BrowserAccessTime	When URL was accessed	2023-10-15T14:30:00
BrowserAccessCount	Number of times visited	5
BrowserURL	URL visited	https://www.example.com
Browser	Browser identifier	IE 7-8-9

Collection Method

This collector:

• Searches for index.dat files in multiple locations:

  • Legacy XP paths in Documents and Settings

  • Vista+ paths in Users\*\AppData\Local\Microsoft\Windows

• Collects index.dat files

• Parses using libmsiecf library

• Extracts URLs, timestamps, and visit counts

Usage

IE browsing history reveals web activity and can indicate phishing, malware downloads, or unauthorized access. Investigators use this data to reconstruct web browsing activity, identify malicious websites visited, detect phishing attacks, correlate with downloads and malware infections, and establish user intent through browsing patterns.

Known Limitations

• Only IE 7-9 (later versions use different format)

• Private browsing not recorded

• History can be cleared by users

• index.dat format deprecated in modern browsers

Notes

IE 7-9 is deprecated but may still be found on legacy systems. This collector is maintained for backward compatibility. Cross-reference with Edge/Chromium history on modern systems.