Application Data Files

[mike2002]

An interesting feature among Forums is security concerning the deletion of viewed websites. TIF and Index.dat files can be erased with confidence.

But I am completely baffled by what can be viewed in the Application Data Files, even AFTER these files have been Deleted and/or Erased several times with a file overwriting program.
The mystery is how these files can display different data when the same file is viewed several times, whilst erasing or deleting in-between viewings.

Example: After deleting and erasing the 'Folders' file several times, a list of all the pages I recently accessed in the PC Guide forum appeared. I deleted the file and the data was absent at the next viewing. After experimentally erasing and deleting the file a couple more times, the same PC Guide data was back again.
Where is it stored for this information to reappear?

A Sent e-mail also showed up, even (again) after deleting and overwriting.

Can anyone give me the definative answer?
So much for security!!!

[Eutychus]

If I understand what you are saying, your ISP may be caching pages visited by their users. I have encountered the situation of viewing old pages (even on this site) after clearing my PC of all cached pages and history - even manually verifying that all temporary Internet files are gone. I am webmaster for several sites and have set meta tags to NOT cache some pages, but I still see old versions of pages that I have changed. This only occurs on one ISP connection (through a proxy server at work). I have learned to always refresh pages on certain sites.

I never have the problem at home, even though my settings are the same.

[Paul Komski]

If you are deleting the index.dat files from windows then they will just be recreated since they are super-hidden files.

PCGuide thread (http://www.pcguide.com/ubb/Forum2/HTML/003089.html)

NetSecurity (http://netsecurity.about.com/library/weekly/aa020402a.htm)

Also; do you compact your folders in OE (if that is what you are using) after deleting messages?


[This message has been edited by Paul Komski (edited 05-26-2002).]

[mjc]

One thing about the index.dat....if you delete it and everything else in the folder (let's say History folder) then when you next boot it will be recreated, but it will be "empty" until you start an online session. There are ways of unhiding the index files, and once that is done you can then look at them with a text editor....and I suppose edit them also.

Also to truly delete the above mentioned files you must do it outside of Windows (at least in the 9x version), which means in DOS. Or if done within Windows a reboot must happen, and you need to get the correct folder because some of what you see as folders are not really folders where the data is stored because it has been encrypted and stored in a "protected folder" (basically what that means is Windows lies about where it is at...), so if you look in Temp Internt Files and see cookies....they aren't there but they are in the Cookies folder....

------------------
mjc
Links list:Computer Links (http://www.dreamwater.org/tech/mjc/index.htm)

Celts are the men that heaven made mad, For all their battles are merry and their songs are all sad.


[This message has been edited by mjc (edited 05-26-2002).]

[mike2002]

Paul. Yes I do 'compact' the Folders each time - it does reduce the
viewing size.
To the guys that have replied, these files (as far as viewing them is concerned) are nothing to do with any Index.dat files.
The Application Data Files have a .dbx extension. If you alter or delete the actual text inside them, Outlook Express won't work afterwards. So be warned!! But strangely enough, if you Delete the whole file, Outlook Express will re-create it just like the TIF files.
I continue to be baffled!

[mjc]

If you remove the .dbx files and any index files associated with that account there should be nothing hangin around to recreate the file from...yes as long as a particular folder is still in use (like the Inbox) then it will be recreated, but it should be a small (under 64k) file that has no emails in it until you check your mail.

A couple of things that I think I mentioned before.....

1. A number of these folders are not "real" they just look like folders.

2. Windows plays games (hiding,scrambling, etc) with the actual data, ostensibly to prevent someone from "spying" on you (looking at the dbx files before firing up OE and then while it is running and after it is shut down--the displayed contents of any one file are not same -- even doing it offline)

3. Deleting the files and any index files (along with the typed URL reg key for IE) in DOS (or outside a Windows session -- not quite sure how to do a complete wipe in 2K/XP, maybe boot to the command prompt (?)), should remove them completely.

4. Yes, they will be rebuilt, but if you have removed ALL your emails (delete them inside OE first then delete the "deleted messages" dbx, ALL your cookies, ALL other (like auto-complete info, typed URLS, etc), what gets rebuilt should be the default/blank files. If you have any cookies left then they will be included in the rebuild...

I think things like this are one of the reasons Win9x needs to be periodically reinstalled...the typed URLS are stored in the Registry and if they are never cleaned out then a years worth would make the Registry very large and quite probably so unwieldly that windows would not be able to function.

------------------
mjc
Computer Links (http://www.dreamwater.org/tech/mjc/index.htm)

Celts are the men that heaven made mad, For all their battles are merry and their songs are all sad.

[mike2002]

Mmmmmm - starts getting complicated doesn't it. OK here's some more to make you think.
Proceedure: All Index.dat files, TIF, Cookie files, etc etc, erased with Tracks Eraser Pro. In addition (for what's it's worth) SWAP file deleted in DOS mode.
Next, all e-mails from OE manually deleted (all folders are now empty).
'Compact' all folders, then erase DBX files with either Tracks Eraser Pro or another similar program. Open OE again to re-create DBX files, delete the Microsoft 'Welcome' message, then Compact again. Repeat proceedure several times - Erase, re-create, compact, erase, re-create, compact etc. View DBX files again; what do we find, an e-mail message in it's entirety that I received several days ago.
Not only that, but some text from a webpage (also accessed several days ago) regarding Popcorn was there. What's it got to do with the 'Sent Items', 'Outbox' folders etc? Nothing dodgy or iffy in any of this - but where does this stuff come from? Why little snippets from just one website or one e-mail- why not every site or every e-mail?
They talk about erasing a hard drive if you sell a computer on. But how can you - when things like this 'rise' from the deleted graveyard!!

[Paul Komski]

Have you had a read of
THIS (http://netsecurity.about.com/gi/dynamic/offsite.htm?site=http://membrane.com/security/secure/Microsoft%5FIs%5FUnscrupulous.html) especially section 5.

------------------
Take nice care of yourselves - Paul
"People in glasshouses ..... shouldn't undress during daylight!"

[mike2002]

Thanks. I'll have a good read.