It's not only those who surf adult websites or chat-rooms that might wish to hide their tracks from others. Many people keep sensitive information on shared computers, and have an interest in keeping data private. Windows records a number of user activities in log files. These logs, or histories, can be deleted by users concerned about privacy issues. While bought software can erase history logs, this how-to will equip you to do it yourself for free.
The usage tracks we will be erasing:
- Internet, Cookies and Search History.
- Recently opened documents.
- Save History.
- Run History.
This How-To is aimed at home users concerned about privacy issues. Computer networks at many organizations allow administrators and IT departments to view logs, without requiring access to your logon information, or even your physical computer. These steps do not address such remote/network logging.
Step 1
This guide shows the manual way to delete your usage history tracks. For other methods that are usually faster and easier, see the Alternate Methods section. If you want to do it yourself, complete the following steps.
Step 2
Delete internet history, cookies, temp files and saved form data. For Internet Explorer users:
Bring up Internet Options from the Tools menu, then select "Delete all...". Alternatively delete individual items, using the History Pane accessible from the toolbar button. - Delete cookies - In the same IE Internet Options window, select Delete Cookies. Alternatively delete individual items, accessible using the View Files button.
- Delete temp files - In the same IE Internet Options window, select Delete Files. See Tips for how to manage temporary files.
- Delete saved form and password data by clicking on AutoComplete on the Content tab in Internet Options. Cover your tracks by clicking on the Clear Forms and Clear Passwords buttons.
For Firefox Users:
- Use the ctrl-shift-delete key combination and check the list for what you want to delete (cookies, passwords, form and password data, temp files). Alternatively delete individual items, go to the Tools menu and click Options > Privacy > Cookies > View Cookies to choose which ones to keep and delete.
Step 3
Delete history information stored in the registry: Opened & Saved documents; Search history & Run history. Spybot Search & Destroy (see External Links) is a free tool which can remove registry stored histories. Install Spybot.
Step 4
Run Spybot, and click Check for Problems. Wait for the report. When it appears, right-click a found entry and click Select All. Alternatively, in the report, select individual usage tracks for deletion. Some you may wish to keep.
- Find the high-up button called Fix All Problems. Registry tracks are now deleted.
Step 5
Recognize that at this point all your PC's standard histories are now erased. Only true privacy enthusiasts will want to complete the following additional steps to delete the hidden history files. XP's hidden history files (index.dat files) are encoded in hexadecimal, not as text, so only the hackers amongst us will ever read them. Should you wish to erase these tracks, continue, perhaps most users would not need to.
The screenshot shows that a determined audit of a computer can show a list of visited web sites using free software (Super WinSpy, see How to Recover Deleted History in Windows, can view many types of hidden history).
Step 6
Bring up an Explorer window listing all your computer's "index.dat" files. To do this, in Windows Explorer right-click C:\ drive and click Search, then For Files & Folders. Click option All Files & Folders, and enter "index.dat" in the Filename field.
Before searching, check the following options using the More Advanced Options line:
- Search System Files
- Search Hidden Files & Folders
- Search Subfolders
Step 7
When searching completes you have a list of the hidden index.dat files on your computer.
Step 8
Overwrite the History contained in your target index.dat file, using a hex file editor such as PS Pad. Install PS Pad.
Right-click an index.dat from your previous search results and choose "PSPad Hex" in the content menu. It will open for editing in hex mode. The screenshot shows an example file listing a history of opened Office files. - Ensure you are not editing in Read-Only mode by trying to type a zero in the first field. Read-Only mode can be toggled on and off in the file menu of PSPad.
Overwrite each position in the file with zeroes (0), by navigating to the first entry and then just holding down the zero key. If you wish to overwrite specific lines in the file, then just navigate to a line using the scroll bar. The screenshot shows the same file overwritten with zeroes. - Save the file.
- Do the same to any other "index.dat" file you wish to erase.
Step 9
Enjoy deleted user tracks.
Tips
- If you don't want to complicate your life with manual tracks erasing, buy a program to do it for you such as CCleaner, OSPC: Privacy Cleaner, East-Tec Eraser 2007, Evidence Eliminator, Tracks Eraser Pro, or Window Washer (see External Links).
- Set IE to automatically delete temporary files when it closes. The option can be found in the Advanced tab under IE's Tools/Internet Options menu item. Alternatively, install IE replacement Firefox, which offers a "Clear Private Data" tool (see External Links).
- After erasing your tracks, delete all System Restore points for good measure. The registry can be restored to a previous state using this tool.
- To prevent forensic analysis of your hard drive, write over the empty space of your hard drive using a tool such as Eraser (see External Links).
- To disable the Recent Documents section on your start menu. Right click on the Start button. Click on Properties. Go to the Start Menu Tab. Then Click the "Customize..." button. Go to the Advanced Tab. Then at the botton you'll see a recent documents section where you can uncheck "List my most recently opened documents". And theres also a button that you can use to Clear the List and still keep that portion in the start menu.
- Windows maintains a DNS cache to help it find web pages. To see a list of recent web pages viewed open a CMD window (click CMD in the 'run' box) and type ipconfig /displaydns. The cache can be emptied by typing ipconfig /flushdns.
Alternate Methods
- Consider having a program do the work for you. One program which appears to automate most/all of the following manual steps is CCleaner. See External Links.
Warnings
- Don't change computer settings for other users without asking. It would be a nuisance. Satisfy yourself that you have a right to alter computer settings. Changing computer content without legal right is a crime in many countries.
- In some limited circumstances it may be possible for an expert to reverse these changes.
- Attempting to hide your computer usage at work is likely to bring you into conflict with management policy. Network administrators can access server logs that detail network and workstation activity, and firewalls can also keep logs. ISPs also keep their own logs.
- System file changes you undertake yourself are potentially dangerous, and under your own risk.
External Links
