Recipe Difficulty: Medium

Python Version: 2.7

Operating System: Linux

Internet history can be invaluable during an investigation. These records can give insight into a user's thought process and provide context around other user activity occurring on the system. Microsoft has been persistent in getting users to use Internet Explorer as their browser of choice. As a result, it is not uncommon to see internet history information present in index.dat files used by Internet Explorer. In this recipe, we scour the evidence file for these index.dat files and attempt to process them using pymsiecf.