What Microsoft Hides On Your Computer

[pultneytooner]

There are folders on your computer that Microsoft has tried hard to keep secret. Within these folders you will find two (major) things: Microsoft Internet Explorer has been logging all of the sites you have ever visited -- even after you've cleared your cache, and Microsoft's Outlook and Outlook Express has been logging ALL of your e-mail correspondence -- even after you've erased them from your trashbin. (This also includes all incoming and outgoing e-mail attachments.) And believe me, that's not even the half of it.
When I say that these files are hidden well, I really mean it. If you don't have any knowledge of DOS, then don't plan on finding these files on your own. I say this because some of these files will only be found in DOS while some of these folders can only be found in Windows Explorer. Additionally, there are some folders that will not be displayed by neither DOS nor Explorer -- but can only be found using a workaround. Basically what I am saying is if you didn't know these files existed then the chances of you running across them is slim to slimmer.
To give you an example of how sneaky this is, there are three hidden folders that may contain your name, address, phone, all the sites you've visited, every single e-mail you've sent/received, every attachment you've ever sent/received, everything you've searched for in a search engine, every filename you've downloaded, names of documents containing "sensitive" information, copies of all your cookies, full readable e-mail from your hotmail account, your PGP keys, and more.
Funny that Microsoft would make no mention of this on microsoft.com.

Written with Windows 9x in mind, but not limited to.
I wonder how true any of this is.

[fred]

I wonder how true any of this is.

I think that was written about Windows 95, it's a long time since I last saw it anyway.

[Cedric Farthsbottom III]

Big Brother is always watching.[para] [para]

[pultneytooner]

I think that was written about Windows 95, it's a long time since I last saw it anyway. Not sure, fred, but if it's the if this is the norm on a windows O.S then it is totally bad news for the pc user.

[EDDIE]

No matter what you do or delete from your computer the information always remains invisable on your hardrive you can buy software to recover the files and tell what you have been doing on your computer and the software can bring back files that have passwords internet history as well and thats on all versions of windows you dont need to be a whizz kid to do that the software does it all for u

[pultneytooner]

No matter what you do or delete from your computer the information always remains invisable on your hardrive you can buy software to recover the files and tell what you have been doing on your computer and the software can bring back files that have passwords internet history as well and thats on all versions of windows you dont need to be a whizz kid to do that the software does it all for u
This seems to have very serious implications if your computer was sold or even stolen, people could get access to private data such as bank details and such.

[codex]

That wats happens when you use net explorer....Im grateful i dont use net explorer such a pile of poo poo

[EDDIE]

This seems to have very serious implications if your computer was sold or even stolen, people could get access to private data such as bank details and such.
If u keep important info on ure computer your best to destroy the harddrive and replace it with another one if your selling it but its not just computers its any gadget that has memory on like a phone or camera u can retrieve deleted information easily

[The Angel Of Death]

Either that or use a program like cyberscrub it uses a 32 delete pass to wipe stuff off and then re writes with random info

[fred]

No matter what you do or delete from your computer the information always remains invisable on your hardrive you can buy software to recover the files and tell what you have been doing on your computer and the software can bring back files that have passwords internet history as well and thats on all versions of windows you dont need to be a whizz kid to do that the software does it all for u

Deleting a file does nor remove it, it just replaces the first letter of the filename in the File Allocation Table with a "?" to tell windows that the file is no longer needed and the disk space it occupied is available. You can use DOS undelete or any disk editor which uses direct disk access to change the first letter to something else and the file is back again, provided it hasn't been overwritten.

[Sandra]

Would re-formatting the hard drive before selling a PC remove the hidden files?

[sam]

isnt this how the police have been able to prove some criminal's have been in sites where they shouldnt of been

[The Angel Of Death]

Yea just ask gary glitter he deleted his stuff as well !!!

When stuff gets deleted it still remains on the machine its just tagged to overide if space is needed and untill its needed you can still recover it

[sam]

then surely in some cases it can only be a good thing

[The Angel Of Death]

Depends thing is if you got anything "dodgey" on the pc then you should know how to securly delete it in the first place

All important info get the full treatment from the prog i use (cyber scrub) it claims to be beyone dod (department of defence)


A secure (but slower) 13 pass wipe method, exceeding the U.S. Department of Defense (DoD) standards. The first 3 passes are with random patterns, the next 7 passes are the standard passes from the DoD standard and the last 3 passes are with random patterns. The last pass is checked. It can be used to wipe data on compressed drives.

This is what it says for the top level of deletion (Gutmann) but it takes ages to delete stuff though


A maximum security (but slow) 35 pass sanitize method, based on Peter Gutmann's paper "Secure Deletion of Data from Magnetic and Solid-State Memory". The method is designed to erase data regardless of the disk raw encoding. It effectively removes the magnetic remnants from disk, preventing hardware recovery tools from restoring any data. NOTE: This method stops both software and hardware recovery tools.

[fred]

Would re-formatting the hard drive before selling a PC remove the hidden files?

Formatting a disk clears the File Allocation Tables so deleted files can't be undeleted. However it doesn't overwrite the entire disk so someone could still use a direct access disk editor to examin the disks contents.

[Ricco]

Hmmmm... I notice that the author of this report fails to actually name these files or hint at where they are located. If I were warning the public I would certainly scream out the filenames and give detailed explanation on their removal.;)

[pultneytooner]

Hmmmm... I notice that the author of this report fails to actually name these files or hint at where they are located. If I were warning the public I would certainly scream out the filenames and give detailed explanation on their removal.;)
4.0. STEP-BY-STEP GUIDE THROUGH YOUR HIDDEN FILES

This next section is intended for the savvy user.

The most important files to be paying attention to are your "index.dat" files. These are database files that reference your history, cache and cookies. The first thing you should know is that the index.dat files is that they don't exist in less you know they do. They second thing you should know about them is that some will *not* get cleared after deleting your history and cache.

The result: A log of your browsing history hidden away on your computer after you thought you cleared it.

To view these files, follow these steps:

In MSIE 5.x, you can skip this first step by opening MSIE and going to Tools > Internet Options > [Settings] > [View Files]. Now write down the names of your alphanumeric folders on a piece of paper. If you can't see any alphanumeric folders then start with step 1 here:

1) First, drop to a DOS box and type this at prompt (in all lower-case). It will bring up Windows Explorer under the correct directory.

c:\windows\explorer /e,c:\windows\tempor~1\content.ie5\

You see all those alphanumeric names listed under "content.ie5?" (left-hand side.) That's Microsoft's idea of making this project as hard as possible. Actually, these are your alphanumeric folders that was created to keep your cache. Write these names down on a piece of paper. (They should look something like this: 6YQ2GSWF, QRM7KL3F, U7YHQKI4, 7YMZ516U, etc.) If you click on any of the alphanumeric folders then nothing will be displayed. Not because there aren't any files here, but because Windows Explorer has lied to you. If you want to view the contents of these alphanumeric folders you will have to do so in DOS. (Actually, this is not always true. Sometimes Windows Explorer will display the contents of these folders -- but mostly it won't. I can't explain this.)

2) Then you must restart in MS-DOS mode. (Start > Shutdown > Restart in MS-DOS mode. ME users use a bootdisk.)

Note that you must restart to DOS because windows has locked down some of the files and they can only be accessed in real DOS mode.

3) Type this in at prompt:

CD\WINDOWS\TEMPOR~1\CONTENT.IE5
CD %alphanumeric%

(replace the "%alphanumeric%" with the first name that you just wrote down.)

DIR/P

The cache files you are now looking at are directly responsible for the mysterious erosion of HD space you may have been noticing. One thing particularly interesting is the ability to view some your old e-mail if you happen to have a Hotmail account. (Oddly, I've only been able to retreive Hotmail e-mail, and not e-mail from my other web-based e-mail accounts. Send me your experiences with this.) To see them for yourself you must first copy them into another directory and THEN open them with your browser. Don't ask me why this works.

A note about these files: These are your cache files that help speed up your internet browsing. It is quite normal to use this cache system, as every major browser does. On the other hand. It isn't normal for some cache files to be left behind after you have instructed your browser to erase it.

5) Type this in:

CD\WINDOWS\TEMPOR~1\CONTENT.IE5
EDIT /75 INDEX.DAT

You will be brought to a blue screen with a bunch of binary.

6) Press and hold the [Page Down] button until you start seeing lists of URLs. These are all the sites that you've ever visited as well as a brief description of each. You'll notice it records everything you've searched for in a search engine in plain text, in addition to the URL.

7) When you get done searching around you can go to File > Exit. If you don't have mouse support in DOS then use the [ALT] and arrow keys.

8) Next you'll probably want to erase these files by typing this:

C:\WINDOWS\SMARTDRV
CD\WINDOWS
DELTREE/Y TEMPOR~1

(replace "cd\windows" with the location of your TIF folder if different.)

This will take a seriously long time to process. Even with Smartdrive loaded.

9) Then check out the contents of your History folder by typing this:

CD\WINDOWS\HISTORY\HISTORY.IE5
EDIT /75 INDEX.DAT

You will be brought to a blue screen with more binary.

10) Press and hold the [Page Down] button until you start seeing lists of URLS again.

This is another database of the sites you've visited.

11) And if you're still with me, type this:

CD\WINDOWS\HISTORY

12) If you see any mmXXXX.dat files here then check them out (and delete them.) Then:

CD\WINDOWS\HISTORY\HISTORY.IE5
CD MSHIST~1
EDIT /75 INDEX.DAT

More URLs from your internet history. Note, there are probably other mshist~x folders here so you can repeat these steps for every occurence if you please.

13) By now, you'll probably want to type in this:

CD\WINDOWS
DELTREE/Y HISTORY

[fred]

Hmmmm... I notice that the author of this report fails to actually name these files or hint at where they are located. If I were warning the public I would certainly scream out the filenames and give detailed explanation on their removal.;)

He did in the version I read but it's a long time ago so I don't remember just what they were, there was the IE cache files and some *.dat files. I seem to remember most of them showed up on windows for me.