• 0Shopping Cart
Digital Detective
  • Home
  • Corporate
    • About Us
      • Executive Team
      • Our Clients
      • Testimonials
    • News and Events
      • Latest News
      • Press Release
    • Legal
      • Privacy Policy
      • Cookie Policy
      • Returns Policy
  • Products
    • Forensic Software
      • NetAnalysis®
      • HstEx®
      • Blade®
    • Downloads
      • Evaluation Request
      • Free Digital Forensic Tools
    • Product Documentation
      • NetAnalysis® Documentation
      • HstEx® Documentation
      • Blade® Documentation
  • Careers
  • Support
    • Knowledge Base
    • Support Portal
    • Digital Forensics Forum
  • Store
    • Forensic Software
    • View Shopping Cart
  • Blog
  • Contact Us
  • Search
  • Menu Menu

Userdata History Type in Internet Explorer

Digital Forensics, Forensic Analysis, Web Browser Forensics
Hands typing on computer keyboard

Introduction to Userdata

Internet Explorer 8+ user data persistence is a function which allows online forms to save a small file to the system with information about values entered in a particular form.  This allows the user to retrieve a half filled web based form when they revisit.

Persistence creates new opportunities for website authors.  Information that persists beyond a single page without support from the server, or within the finite scope of cookies, can increase the speed of navigation and content authoring.

The folder structure where the data is actually stored is very much like the standard Internet Explorer cache folder structure. Inside the cache folder you will find the files containing data attributed to the associated website.

{user}\AppData\Roaming\Microsoft\Internet Explorer\UserData\

To demonstrate how this works, we have created a page which allows you to save a string to the local drive.

  • Digital Detective Training – UserData Example Page

Once you have saved some string data using the above page, open the UserData INDEX.DAT file in NetAnalysis and review the entries.  Selecting F8 will bring up the search/filter dialogue.  Change the field name to ‘Type’ and enter ‘userdata’ in the filter text box.  When this is executed, you should find an entry as shown below:

If you navigate to the corresponding folder, you will find an XML file which contains the string you entered into the website.  This is shown below.

18th January 2011/1 Comment/by Craig Wilson
Tags: Browser Evidence, Internet Explorer
Share this entry
  • Share on Facebook
  • Share on Twitter
  • Share on WhatsApp
  • Share on Pinterest
  • Share on LinkedIn
  • Share on Tumblr
  • Share on Vk
  • Share on Reddit
  • Share by Mail
You might also like
Keyboard with chain and palock Microsoft Internet Explorer PrivacIE Entries
Microsoft Internet Explorer Daily/Weekly INDEX.DAT Files
Computer keyboard with red enter key being pressed NetAnalysis® v1.52 – USB Dongle, Google Chrome Support and Export/Rebuild Entire Cache Option
Casey Anthony and Jose Angel Baez standing during the murder trial Digital Evidence Discrepancies – Casey Anthony Trial
Internet Explorer logo over a computer keyboard Understanding Microsoft Internet Explorer Cache
Cookies next to a laptop keyboard Random Cookie Filenames
Clock dial showing hands approching 12 o' clock NetAnalysis® Date and Time Fields
Random binary data with magnifying glass showing the text REDIRECT in red Understanding Redirects
1 reply
  1. Paul Bobby
    Paul Bobby says:
    18th January 2011 at 14:33

    Great artifact – thank you for your continued research.

Comments are closed.

Categories

Recent Posts

  • DataDump™ – Data Extractor and Converter
  • DCode™ – The Digital Detective’s Companion Across Time
  • NetAnalysis® v3.8: Enhanced Browser Support for Digital Forensic Investigations
  • NetAnalysis® v3.7 and HstEx® v5.7 Released
  • NetAnalysis® v3.6 and HstEx® v5.6 Released

Tags

ACPO Alternate Data Stream Android AOL Binary Coded Decimal BOM Browser Evidence Byte Order Mark Change Log Date & Time Decode Dongle Hell Dongles Donor Drive Email Recovery Encode Find Panel Free Good Practice GSM Guidelines Intelli-Carve Internet Explorer iOS Legal Licensing Linux macOS Network Byte Order News NTFS PFC Preferences Prefs PrivacIE Release Notes Seagate Search Symbolic Links Syntax Timestamp Timestamps Tools Tutorial Zone.Identifier

About Us

Digital Detective enhances digital forensic science though cutting edge research and development. We offer a range of products and services for digital forensic analysis and advanced data recovery.

Recent Tweets

Exciting news! Our popular #DataDump tool just got even better with the release of v2.1. Download now for free and experience the difference! #freetool #dataextraction digital-detective.ne…

About 2 years ago from Digital Detective's Twitter via Twitter Web App

Nothing seems to have changed in the last 13 years. lbc.co.uk/news/polic…

About 2 years ago from Digital Detective's Twitter via Twitter Web App

This has been a lot of work; hope you like it. NetAnalysis® v3.3 and HstEx® v5.3 have been released. Lots of new functionality! digital-detective.ne…

About 3 years ago from Digital Detective's Twitter via Twitter Web App

Her Majesty The Queen Elizabeth II 1926 - 2022 pic.twitter.com/sWSC…

About 3 years ago from Digital Detective's Twitter via Twitter for iPad

Recovery and analysis of MFT resident Zone.Identifier alternate data streams and how they are helpful in a forensic investigation. #DFIR #DigitalForensics #BrowserForensics #FileSystemAnalysis digital-detective.ne…

About 4 years ago from Digital Detective's Twitter via Twitter Web App

Follow @DigitalDetectiv

Select Language

Translate our site by selecting your language from the option below.

Contact Us

Digital Detective Group
Motis Business Centre
Cheriton High Street
Folkestone
KENT, CT19 4QJ
United Kingdom

///courts.endearing.bulbs
+44 (0) 20 3384 3587

Copyright © 2001 - 2025 Digital Detective Group Limited
  • Facebook
  • Twitter
  • Youtube
  • Mail
  • Home
  • Sitemap
  • Corporate
  • Products
  • Store
  • Blog
  • Contact
Scroll to top