Tuesday, September 11, 2012

Location of Browser Data

Extract from this URL :  http://kb.digital-detective.co.uk/display/NetAnalysis1/Location+of+Browser+Data

Microsoft Internet Explorer
Microsoft Windows XP
Cookies
C:\Documents and Settings\{user}\Cookies\index.dat

History
C:\Documents and Settings\{user}\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\{user}\Local Settings\History\History.IE5\MSHist01YYYYMMDDYYYYMMDD\index.dat

Cache
C:\Documents and Settings\{user}\Local Settings\Temporary Internet Files\Content.IE5\index.dat

Other
C:\Documents and Settings\{user}\IETldCache\index.dat
C:\Documents and Settings\{user}\PrivacIE\index.dat
C:\Documents and Settings\{user}\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\{user}\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat

Microsoft Windows Vista / 7
AppData\Local\Microsoft
C:\Users\{user}\AppData\Local\Microsoft\Feeds Cache\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat

AppData\Local\Microsoft\Windows\History
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist01YYYYMMDDYYYYMMDD\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat

AppData\Local\Microsoft\Windows\Temporary Internet Files
C:\Users\{user}\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat

AppData\Local\Temp\Low
C:\Users\{user}\AppData\Local\Temp\Low\Cookies\index.dat
C:\Users\{user}\AppData\Local\Temp\Low\History\History.IE5\index.dat
C:\Users\{user}\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\index.dat

AppData\LocalLow
C:\Users\{user}\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

AppData\Roaming
C:\Users\{user}\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IETldCache\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\index.dat

Apple Safari

Microsoft Windows XP

History
C:\Documents and Settings\{user}\Application Data\Apple Computer\Safari\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Apple Computer\Safari\
Microsoft Windows Vista / 7

History
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\

Cache
C:\Users\{user}\AppData\Local\Apple Computer\Safari\

Apple Macintosh OS X 10.6

History
/Users/{user}/Library/Safari/
Cache
/Users/{user}/Library/Caches/com.apple.Safari/

Mozilla Firefox
Microsoft Windows XP

History and Downloads
C:\Documents and Settings\{user}\Application Data\Mozilla\Firefox\Profiles\{profile folder}\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Mozilla\Firefox\Profiles\{profile folder}\Cache\

Microsoft Windows Vista / 7

History and Downloads
C:\Users\{user}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile folder}\
Cache
C:\Users\{user}\AppData\Local\Mozilla\Firefox\Profiles\{profile folder}\Cache\

Apple Macintosh OS X 10.6

History and Downloads
/Users/{user}/Library/Application Support/Firefox/Profiles/{profile folder}/

Cache
/Users/{user}/Library/Caches/Firefox/Profiles/{profile folder}/Cache/

GNU / Linux
History and Downloads
/home/{user}/.mozilla/firefox/{profile folder}/
Cache
/home/{user}/.mozilla/firefox/{profile folder}/Cache/

Google Chrome
Microsoft Windows XP
History
C:\Documents and Settings\{user}\Local Settings\Application Data\Google\Chrome\User Data\Default\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\

Microsoft Windows Vista / 7

History
C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default\
Cache
C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default\Cache\


Apple Macintosh OS X 10.6
History
/Users/{user}/Library/Application Support/Google/Chrome/Default/
Cache
/Users/{user}/Library/Caches/Google/Chrome/Default/Cache/


GNU / Linux
History
/home/{user}/.config/google-chrome/Default/
Cache
/home/{user}/.cache/google-chrome/Default/Cache/

Opera Browser
Microsoft Windows XP
History
C:\Documents and Settings\{user}\Application Data\Opera\Opera\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Opera\Opera\cache\

Microsoft Windows Vista / 7
History
C:\Users\{user}\AppData\Roaming\Opera\Opera\
Cache
C:\Users\{user}\AppData\Local\Opera\Opera\cache\

Apple Macintosh OS X 10.6
History
/Users/{user}/Library/Opera/
Cache
/Users/{user}/Library/Caches/Opera/cache/

GNU / Linux
History
/home/{user}/.opera/
Cache
/home/{user}/.opera/cache/

Wednesday, August 8, 2012

How to Export Events Log including "Event Description" from Windows Event Viewer

This is how you can get the details Event Log Description from Windows Event Viewer. The script is available on Windows OS.

cscript c:\windows\system32\eventquery.vbs /fi "Type eq Information" /fi "Source eq Print" /fi "ID eq 10" /v  /l System /fo csv > Event_Viewer_System.csv

The syntax I used was to filter (/fi) out
    Events equal the type “Information”
    filter out Source equal to “Print”
    filter out ID equal “10"    and have a verbose (/v) output
    from the System log (/l System)
    output as comma separated file (/fo)
    and redirect the result to a file > filename.csv
Sample File Output:
"Information","10","12.05.2009 13:24:48","Print","Servername","None","AD\username","Document 232, filename.pdf owned by username was printed on printername via port IP_192.168.0.254. Size in bytes: 279232; pages printed: 1"

This method also can be use to export from any Event Viewer data log like Application, Security, Internet Explorer or other logs you have on your system.

Source URL: http://technet.microsoft.com/en-us/library/bb490900.aspx

Source URL : http://pario.no/2009/05/13/exporting-events-including-event-properties-from-windows-event-viewer/

Source URL: http://pario.no/2009/05/15/simple-windows-print-accounting-using-event-viewer-data/

Tuesday, July 31, 2012

Where is "scanpst.exe" location in Windows

Here is the location:

The Scanpst.exe file is typically located in one of the following folders:
<disk drive>:\Program Files\Common Files\System\Mapi\1033\
<disk drive>:\Program Files\Common Files\System\MSMAPI\1033

For Microsoft Windows NT and Microsoft Windows 2000:
C:\Program Files\Common Files\System\Mapi\1033\NT

For Microsoft Windows 95 and Microsoft Windows 98:
C:\Program Files\Common Files\System\Mapi\1033\95

The Scanpst.exe file for Outlook 2007 is is typically located in the following folder:
<disk drive>:\Program Files\Microsoft Office\Office12
<disk drive>:\Program Files(x86)\Microsoft Office\Office12

The Scanpst.exe file for Outlook 2010 is typically located in the following folder:
<disk drive>\Program Files\Microsoft Office\Office14
<disk drive>\Program Files\Microsoft Office(x86)\Office14


URL Detail : http://support.microsoft.com/kb/272227

How to repair PST files in bulk? Automate it!
http://www.rethinkit.com/blog/tech-tip-outlook-how-to-bulk-fix-pst-files-scanpstall/

Thursday, July 19, 2012

Windows Logon Types

Logon Type 0 = System Only
Logon Type 1 = unknown
Logon Type 2 = Interactive Logon
Logon Type 3 = Network
Logon Type 4 = Batch
Logon Type 5 = Service
Logon Type 6 = (proxy logon)
Logon Type 7 = Unlock Workstation
Logon Type 8 = Network Clear Text
Logon Type 9 = New Credentials
Logon Type 10 = Remote Interactive (Windows XP and newer operating systems only).
Logon Type 11 = Cached Interactive
Logon Type 12 = CachedRemoteInteractive
Logon Type 13 = CachedUnlock

Sources URL: http://markparris.co.uk/2009/11/08/windows-logon-types


Detail Explanation URL: http://www.windowsecurity.com/articles/logon-types.html

Monday, July 2, 2012

Where are the Windows registry files located in Windows 7?

Windows 7: Path to Registry Directory 
 C:\Windows\System32\config
C:\Users\[username]\Ntuser.dat
C:\Users\[username]\AppData\Local\Microsoft\Windows\UsrClass.dat

1. First – the most important main directory:
C:\Windows\System32\config

2. Next, there’s another important path that is unique for each user:
C:\Users\[username]\Ntuser.dat

3. There’s also a unique registry file for all COM infos:
C:\Users\[userame]\AppData\Local\Microsoft\Windows\UsrClass.dat

    Security – HKEY_LOCAL_MACHINE\SECURITY
    Software – HKEY_LOCAL_MACHINE\SOFTWARE
    Sam – HKEY_LOCAL_MACHINE\SAM
    System – HKEY_LOCAL_MACHINE\SYSTEM
    Default – HKEY_USERS\.DEFAULT
    Userdiff - (for upgrading systems)
    Users – HKEY_USERS
    COM Info – COM

URL: http://windows7themes.net/windows-7-path-to-registry-directory.html


Location of Windows registry files:

HKEY_LOCAL_MACHINE \SYSTEM : \system32\config\system
HKEY_LOCAL_MACHINE \SAM : \system32\config\sam
HKEY_LOCAL_MACHINE \SECURITY : \system32\config\security
HKEY_LOCAL_MACHINE \SOFTWARE : \system32\config\software
HKEY_USERS \UserProfile :  \winnt\profiles\username
HKEY_USERS.DEFAULT : \system32\config\default

URL : http://www.thewindowsclub.com/where-are-the-windows-registry-files-located-in-windows-7

Tuesday, June 12, 2012

Friday, February 3, 2012

How Windows 7 knows it has an internet connection

Today I got a news splash from CodeProject and one of the topic was "Connectivity Test". Hemmmmm...very interesting and I follow the link. Actually it was a conversation among the programmers, I follow through the conversations and I learn something new today. One of the them gave some very useful tips on "How Windows 7 knows it has an internet connection".

Here is the details URL Link: Windows 7 Network Awareness: How Windows knows it has an internet connection

Hope you find this post useful. Thanks. ;).