Microsoft Internet Explorer PrivacIE Entries

Microsoft Internet Explorer PrivacIE Entries

Internet Explorer introduced a number of new security and privacy features in version 8.  One of these new features was InPrivate Filtering.  InPrivate Filtering helps prevent the web sites a user visits from automatically sending details about the visit to other content providers.

PrivacIE_Warning

When a user visits a web site, it automatically shares standard computer information with that web site.  If the web site contains content provided by a third-party web site (for example a map, advertisement, or web measurement tools such as a web bug or scripts) some information about the user may be automatically sent to the content provider.

This type of arrangement can have several benefits. It lets the user conveniently access third-party content.  The presence of advertising on a web site may let the web site provide access to premium content at no charge.  However, there can be an impact on user privacy as a result because it is possible for the content providers to track the user across multiple web sites.

When InPrivate Filtering is used, some web sites might be prevented from automatically sharing details about the visit with the providers whose content is displayed.  As a result, some content might be automatically blocked (such as weather information or advertisements).  The user can manually allow blocked content by adjusting the InPrivate Filtering settings.

PrivacIE INDEX.DAT Entries

When performing a forensic examination of INDEX entries from Internet Explorer, you may come across numerous PrivacIE Type entries.  These entries are URL records for third-party content providers.

If the user has InPrivate filtering on, the PrivacIE INDEX.DAT stores the URLs to third party content.  They are not InPrivate browsing records.  InPrivate Filtering helps prevent website content providers from collecting information about sites the user has visited.

For example, the Digital Detective web sites use Google Analytics to track information about visitors to our sites.  Google tracks the data and provides webmasters with analytical tools to review the results.

If you switch InPrivate filtering on and visit the Digital Detective Website, you will find two entries in the PrivacIE INDEX which get generated from the visit.

PrivacIE_Google_Entries

The first entry is a web bug which takes the Google Analytic information as a command line paramter.  The second entry is a Google Analytic script.

Removing InPrivate Filter Entries

The user can remove the (PrivacIE) entries relating to InPrivate Filtering in the same way as clearing the History or Cache.  In the Delete Browsing History dialogue, there is an entry for InPrivate Filtering as shown below.
Remove_InPrivate_Filtering_Data
Internet Explorer can also be configured not to record this information, even if the functionality is active.
InPrivate_Don_Not_Collect_Data
Recovering Evidence of InPrivate Browsing
I will post an article at a later date regarding InPrivate browsing and the recovery of InPrivate history.
The original KB Article is here:  KB80054 What are Internet Explorer PrivacIE Entries