Sunday, August 23, 2026

PowerShell Scripting: Converts list-view CSV data into table-view CSV format

Some time I need this script Converts list-view CSV data into table-view CSV format.

---------------------------------------------------------------------------------------------------------------------------------
<#
.SYNOPSIS
    Converts list-view CSV data into table-view CSV format.

.DESCRIPTION
    Reads a CSV-like file containing repeated key/value pairs separated
    by blank rows and converts each group into a PowerShell object.

    The resulting objects are exported as a standard table-format CSV.

.PARAMETER InputFile
    Path to the source list-view CSV file.

.PARAMETER OutputFile
    Path to the destination table-view CSV file.

.EXAMPLE
    .\Convert-ListViewToTable.ps1 `
        -InputFile ".\ListViewData.csv" `
        -OutputFile ".\TableViewData.csv"

.EXAMPLE
    .\Convert-ListViewToTable.ps1 `
        -InputFile "C:\Data\Input.csv" `
        -OutputFile "C:\Data\Output.csv"
        
.NOTES
    File Name : Convert-ListViewToTable.ps1
    Author    : mimi
    Purpose   : Convert list-view key/value CSV data into table-view CSV format.
    Version   : 1.0
#>

[CmdletBinding()]
param (
    [Parameter(
        Mandatory = $true,
        Position = 0,
        HelpMessage = "Specify the input list-view CSV file."
    )]
    [ValidateNotNullOrEmpty()]
    [ValidateScript({
        if (-not (Test-Path -LiteralPath $_ -PathType Leaf)) {
            throw "Input file does not exist: $_"
        }

        $true
    })]
    [string]$InputFile,

    [Parameter(
        Mandatory = $true,
        Position = 1,
        HelpMessage = "Specify the output table-view CSV file."
    )]
    [ValidateNotNullOrEmpty()]
    [string]$OutputFile
)

try {

    # Resolve the input path
    $InputFile = (Resolve-Path -LiteralPath $InputFile).Path

    # Convert output path to an absolute path
    $OutputFile = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath(
        $OutputFile
    )

    Write-Verbose "Input file : $InputFile"
    Write-Verbose "Output file: $OutputFile"

    # Make sure the output directory exists
    $OutputDirectory = Split-Path -Path $OutputFile -Parent

    if (-not (Test-Path -LiteralPath $OutputDirectory -PathType Container)) {
        throw "Output directory does not exist: $OutputDirectory"
    }

    $Records = [System.Collections.Generic.List[object]]::new()
    $CurrentRecord = [ordered]@{}

    foreach ($Line in Get-Content -LiteralPath $InputFile) {

        # Blank line or "," indicates the end of a record
        if (
            [string]::IsNullOrWhiteSpace($Line) -or
            $Line.Trim() -eq ","
        ) {

            if ($CurrentRecord.Count -gt 0) {

                $Records.Add(
                    [PSCustomObject]$CurrentRecord
                )

                $CurrentRecord = [ordered]@{}
            }

            continue
        }

        # Split only on the first comma
        $Parts = $Line -split ',', 2

        $Key = $Parts[0].Trim()

        if ($Parts.Count -gt 1) {
            $Value = $Parts[1].Trim()
        }
        else {
            $Value = ""
        }

        # Ignore empty property names
        if (-not [string]::IsNullOrWhiteSpace($Key)) {
            $CurrentRecord[$Key] = $Value
        }
    }

    # Add the final record if the file doesn't end
    # with a blank/separator line
    if ($CurrentRecord.Count -gt 0) {
        $Records.Add(
            [PSCustomObject]$CurrentRecord
        )
    }

    if ($Records.Count -eq 0) {
        throw "No records were found in the input file."
    }

    # Export as normal table-view CSV
    $Records |
        Export-Csv `
            -LiteralPath $OutputFile `
            -NoTypeInformation `
            -Encoding UTF8

    Write-Host "Conversion completed successfully."
    Write-Host "Records converted : $($Records.Count)"
    Write-Host "Output file       : $OutputFile"
}
catch {
    Write-Error "Conversion failed: $($_.Exception.Message)"
    exit 1
}

---------------------------------------------------------------------------------------------------------------------------------

Save it as Convert-ListViewToTable.ps1 and run it like this:

.\Convert-ListViewToTable.ps1 ` -InputFile ".\ListViewData.csv" ` -OutputFile ".\TableViewData.csv"

or Or because I've defined Position, this also works:

.\Convert-ListViewToTable.ps1 ".\ListViewData.csv" ".\TableViewData.csv"


For troubleshooting, you can use -Verbose:

.\Convert-ListViewToTable.ps1 ` -InputFile ".\ListViewData.csv" ` -OutputFile ".\TableViewData.csv" ` -Verbose




Monday, April 16, 2018

Tracking Account Usage on Domain Environment

Tracking Account Usage on Domain Environment

Operating Systems:
Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10

Domain controller successfully authenticates a user via NTLM Protocol:
4776: The domain controller attempted to validate the credentials for an account
      Logon Account: name of the account
      Source Workstation: computer name where logon attempt originated
      Error Code:
            C0000064 - user name does not exist
            C000006A - user name is correct but the password is wrong
            C0000234 - user is currently locked out
            C0000072 - account is currently disabled
            C000006F - user tried to logon outside his day of week or time of day restrictions
            C0000070 - workstation restriction
            C0000193 - account expiration
            C0000071 - expired password
            C0000224 - user is required to change password at next logon
            C0000225 - evidently a bug in Windows and not a risk

Domain controller successfully authenticates a user via Kerberos Protocol:

4768: A Kerberos authentication ticket (TGT) was requested (Successful logon)
      Account Name:  logon name of the account that just authenticated
      Client Address:  IP address where user is present

4771: Kerberos pre-authentication failed
      Account Name:  logon name of the account that just authenticated
      Client Address:  IP address where user is present
      Failure Code: 0x18 - Pre-authentication information was invalid
4769: A Kerberos service ticket was requested(Access to server resources)
      Account Name:  logon name of the account that just requested the ticket     
      Client Address:  IP address where user is present
      Service Name:  the account name of the computer or service the user is requesting the ticket for

Tracking Account Usage on Local Window System

Tracking account usage for known compromised accounts.

Event IDs:
4624: An account was successfully logged on
4625: An account failed to log on
4634: An account was logged off
4647: User initiated logoff
4648: A logon was attempted using explicit credentials (Runas)
4672: Account logon with superuser right (Administrator)
4720: A user account was created

4778: A session was reconnected to a Window Station
4779: A session was disconnected from a Window Station

Wednesday, October 19, 2016

Windows security audit events: This spreadsheet details the security audit events for Windows


Note to my self:

You can use Windows security and system logs to record and store collected security events so that you can track key system and network activities to monitor potentially harmful behaviors and to mitigate those risks. You customize system log events by configuring auditing based on categories of security events such as changes to user account and resource permissions, failed attempts for user logon, failed attempts to access resources, and attempts to modify system files. The information in this download can help you analyze the data included in event log data.

https://www.microsoft.com/en-us/download/details.aspx?id=50034
https://download.microsoft.com/download/8/E/1/8E11AD26-98A1-4EE3-9F7F-1DB4EB18BADF/WindowsSecurityAuditEvents.xlsx

Friday, April 24, 2015

PowerShell: Offline Windows Event Logs Analysis - Part 1

1. You already have the raw Windows Event log copy out from the Server using Forensics tools.
Default Event Log Location:
Windows Server 2003 Operating System : %WinDir%\System32\Config
Windwos Server 2008, 2012 R2 Operating System : %WinDir%\System32\Winevt\Logs


2. Repair the Event log!
If the file was not properly closed, the four fields will not have been synched and the file status byte will be odd.  When you attempt to open such a file with any viewer reliant upon the event log API, it will be reported as corrupt.  This frequently occurs in forensics when you pull the plug or do a live acquisition.  EnCase doesn't rely upon that API and will parse them without repair.  If you wish to use them in a viewer reliant upon the event log API, you'll need to repair the header.
To repair the event log file, you simply need to copy the four fields from the floating footer into their corresponding location in the header and then set the file status byte to any even value. Save and you are done.  It's really that simple. (http://www.stevebunting.org/udpd4n6/forensics/repaireventlogfile.htm)


Automated Windows Event Log Repair Tool:
    http://www.cwflynt.com/logFixer
    http://murphey.org/fixevt.html


3. Extracting the XML event log information from save Windows event log
Note: Please run the command line by line so that you can see what it does and the output result.

# Analyzing one event message from event log
# Extract Security.evtx event id "4624" for logon activities from the full path to the saved log file name. Here we assigned the value to "$Event" variable.
PS C:\Users\mimi> $Event = Get-WinEvent -FilterHashtable @{Path="D:\Sample_Event_Log\Win7\Security.evtx";Id=4624} -MaxEvents 1

# We then view the event properties.
PS C:\Users\mimi> $Event | Format-List *

# Now we can view the array of message body values, however the property names are missing.
PS C:\Users\mimi> $Event.Properties

# Now we convert the event to XML and assign the value to "$eventXML" variable.
PS C:\Users\mimi> $eventXML = [xml]$Event.ToXml()

# Walla...now we get all the XML information from the message.
PS C:\Users\mimi> $eventXML.Event.EventData.Data

# Later we have to index each data element to access it.
PS C:\Users\mimi> $eventXML.Event.EventData.Data[0].name
PS C:\Users\mimi> $eventXML.Event.EventData.Data[0].'#text'


-----------------------------------------------------------------------------------------

Full running code:
1. Change the "Path" location to your Windows Event Log and save below Powershell code as "Extract_Security_Evtx_Event_ID_4624_Logon_Activities.ps1"


-----------BEGIN-----------
#Extract Security.evtx event id 4624 - Logon Activities
#------------------------------------------------------

# Extract Security.evtx event id "4624" for logon activities from the full path to the saved log file name.
$Events = Get-WinEvent -FilterHashtable @{Path="D:\Sample_Event_Log\Win7\Security.evtx";Id=4624}

# Assign the Output file to store the output result.
$OutputFile = "D:\Sample_Event_Log\Win7\Security_Evtx_Event_ID_4624_output.csv"

# Parse out the event message data           
ForEach ($Event in $Events)
{           
    # Convert the event to XML           
    $eventXML = [xml]$Event.ToXml()           

    # Iterate through each one of the XML message properties           
    For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++)
    {           
        # Append these as object properties           
        Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'
    }           
}           

# View the results with your favorite output method           
#$Events | Select-Object * | Out-GridView
$Events | Select-Object TimeCreated,MachineName,LogName,Id,SubjectLogonId,TargetUserName,TargetDomainName,WorkstationName,IpAddress,LogonType | Export-Csv $OutputFile -NoType

-----------END-----------
Run it 
PS C:\Users\mimi> .\Extract_Security_Evtx_Event_ID_4624_Logon_Activities.ps1

References:
https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/25/use-powershell-to-parse-saved-event-logs-for-errors/
https://blogs.technet.microsoft.com/ashleymcglone/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs/
https://gallery.technet.microsoft.com/scriptcenter/Log-Parser-to-Identify-8aac36bd

Friday, March 20, 2015

Remote Desktop Protocol (RDP) Logging and Tracking sessions Logon/Logoff activity

Applies To:
Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Vista

Windows Event Log: Security Event
File Location : %windir%\system32\config\SecEvent.Evt
Event ID: 528 - A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below.
Type: 10 - RemoteInteractive - A user logged on to this computer remotely using Terminal Services or Remote Desktop.

More on Remote Desktop Services Availability

Thursday, February 26, 2015

The New Way to Look at Users Properties

The Active Directory Administrative Center is another new component introduced by Windows Server 2008 R2. Many admins gave it a glance, thought to themselves "another ADUC, why bother?", and went back to their familiar old tool. If you like acctinfo.dll though, you should like ADAC.

With Win7 RSAT installed and the AD tools enabled (or RDP'ed into your Win2008 R2 servers for AD administration), run DSAC.EXE. You'll see this:

Here is the detail explanation from the expert http://blogs.technet.com/b/askds/archive/2011/04/12/you-probably-don-t-need-acctinfo2-dll.aspx

Tuesday, October 21, 2014

Tracing User Activities

It would be great if we can have one tool that will be able to tell us what are the user activities or have done on the computer base on date!

May be we can start with this tool.

Name: LastActivityView by Nirsoft
URL: http://www.nirsoft.net/utils/computer_activity_view.htm


Description:
LastActivityView is a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer. The activity displayed by LastActivityView includes: Running .exe file, Opening open/save dialog-box, Opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash, network connection/disconnection and more...

Windows OS: When was a File Deleted?

Can dates of file deletion be obtained? Yes, sometimes.

In a computer forensics examination dates are almost always going to important. Every file on a modern Windows system has numerous dates, from the Created, Modified, Last Written, and Entry Modified dates in the NTFS, to the dates in Link file, registry entries, and folders.

“Was the file deleted before his resignation?”
“Was the file deleted before or after the data preservation order?”
“If the file was deleted on the 1st rather than the 31st, than that means there was a breach of a court order. Can you say when it was deleted?”

All of these questions are asking the same thing: “When was a file deleted?”

NTFS, the standard file system for Windows, does not record a deleted date, however the recycle bin does. When a file is deleted via the recycle bin (i.e when a user clicks delete for a file it is placed in the recycle bin) the recycle bin keeps track of the deletion of the file – when it happend, how big the file was, and where it came from. This information is stored within the INFO2 file of that recycle bin.

Therefore if a file was deleted via the recycle bin the date of deletion can be recovered.

However, if it is not deleted via a recycle bin, this information is not recorded.

Source URL:
http://whereismydata.wordpress.com/2009/04/02/forensics-deleted-dates/
http://whereismydata.wordpress.com/2009/08/16/forensics-when-was-a-file-deleted-part-1/
http://whereismydata.wordpress.com/2009/08/17/forensics-when-was-a-file-deleted-part-2/

Wednesday, June 4, 2014

Windows Registry Hives

A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of its data.

Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.


Registry hive                                          Supporting files
HKEY_CURRENT_CONFIG                 System, System.alt, System.log, System.sav
HKEY_CURRENT_USER                     Ntuser.dat, Ntuser.dat.log
HKEY_LOCAL_MACHINE\SAM            Sam, Sam.log, Sam.sav
HKEY_LOCAL_MACHINE\Security      Security, Security.log, Security.sav
HKEY_LOCAL_MACHINE\Software     Software, Software.log, Software.sav
HKEY_LOCAL_MACHINE\System        System, System.alt, System.log, System.sav
HKEY_USERS\.DEFAULT                    Default, Default.log, Default.sav


Detail URL: http://msdn.microsoft.com/en-us/library/windows/desktop/ms724877%28v=vs.85%29.aspx

Thursday, May 22, 2014

Powershell: Get FQDN of local or remote computer

To get FQDN of local computer:

PS C:\> [System.Net.Dns]::GetHostByName(($env:computerName))

To get FQDN of Remote computer:

PS C:\> [System.Net.Dns]::GetHostByName("notebook01")

Note: 
System.Net.DNS class has a few other useful methods using which you can get FDQN and IP address details.

Refer to http://msdn.microsoft.com/en-us/library/system.net.dns.aspx for more details.

PS C:\> [System.Net.Dns] | Get-Member -Static

Friday, May 2, 2014

How to Use the Cipher Security Tool to Overwrite Deleted Data

To overwrite deleted data on a volume by using Cipher.exe, use the /w switch with the cipher command. Use the following steps:
  1. Quit all programs.
  2. Click Start, click Run, type cmd, and then press ENTER.
  3. Type cipher /w:driveletter:\foldername, and then press ENTER.
To overwrite deleted data on C:\ drive
     C:>Users\user_name\> cipher /w:C:\    and then press ENTER.

To overwrite deleted data on folder
     C:>Users\user_name\> cipher /w:C:\your_folder_name  and then press ENTER.

Note: Specify the drive and the folder that identifies the volume that contains the deleted data that you want to overwrite. Data that is not allocated to files or folders will be overwritten. This permanently removes the data. This can take a long time if you are overwriting a large space. 

Detail URL:  http://support.microsoft.com/kb/315672

Wednesday, April 2, 2014

Microsoft Outlook temporary OLK folder

Where does Microsoft create the Outlook Temporary folder Or store temporary data such as attachments?

Depending on the operating system, version of Outlook AND user logged in, the OLK temporary folder will be created in a different spot. To find where it’s been created, open the Windows registry using regedit32.exe and use the MAP below:

Outlook 97: HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Outlook\Security
Outlook 98: HKEY_CURRENT_USER\Software\Microsoft\Office\8.5\Outlook\Security
 Outlook 2000: HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Security
Outlook 2002/XP: HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
Outlook 2003: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
Outlook 2007: HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security


BackGround:
When you open file attachments that are considered safe, Outlook places these attachments in a subdirectory under the your Temporary Internet Files directory as an extra precaution. When Outlook first tries to use a temporary file, it examines the registry to determine whether or not the TEMP OLK folder has already been created. If yes, it uses the folder. If no, it creates a random folder then stores the path in the registry location mentioned above.


Detail URL: http://www.hancockcomputertech.com/blog/2010/01/06/find-the-microsoft-outlook-temporary-olk-folder/

Friday, November 8, 2013

How to delete a file in Windows with a too long filename?

Solution 1)
From a command prompt:

dir /X

This will list your files or folders in short name format. Then use the short name exactly as written to delete the file:

del LONGFI~1.txt

you are done!  :)
 
Solution 2)
Try this in a Command Prompt.
rd /s first_part_of_subdirectory_name

e.g. if the file is called "C:\temp\Files\verylongfilenames.ext"
rd /s C:\temp\Files
 

Monday, October 28, 2013

What is Encase "Lost Files" folder

This was posted by Jeffery Misner. I want to give credit for the source.

What is the Lost Files folder?


EnCase has a different method (compared to FAT) for recovering deleted files and folders with NTFS evidence files. When you add an NTFS Evidence file to EnCase, you will notice a folder added automatically to the evidence file in the case view called "Lost Files." In the MFT (Master File Table) in NTFS, all files and folders are marked as a folder or file, and are associated to a "parent."

Suppose you have a folder contain many files. Those files are its "children." For those files to become "lost," you delete them along with the folder itself. You then create a new folder. The entry in the MFT for the old folder is overwritten. So the original "parent" folder and its entry in the MFT are gone. But it's "children," while deleted, have not been overwritten, and their entries are still in the MFT. EnCase can then tell what those files are, but there is no longer any record of what folder those files were in. Because of this, all those files (without parent folders anymore) are lumped into the "Lost Files" folder that EnCase creates and places in the Entries view so that you can see those files.

That is different from the recover folders feature, btw. Also note that Lost Files only appear for NTFS volumes since FAT does not work the same way.

Note: There is no way you can see those deleted files without using specialized software like EnCase.

Original source link : http://www.forensicfocus.com/Forums/viewtopic/t=2718/

Thursday, September 26, 2013

How to get hard drive serial number from command line on Windows computer?

Get the Manufacturers serial number of the hard drive.

    C:\>wmic diskdrive get serialnumber

Get the volume serial number:

    C:\>vol C:

Get Drive Info:

    C:>wmic diskdrive list brief
   
Get service tag report:

    C:>wmic csproduct get name,vendor,identifyingNumber



Determine when Windows was installed on a computer

    C:\>wmic OS Get InstallDate
InstallDate
20091204171103.000000+480

You can easly read the above output adding the relevant markup: 2011-02-14 13:36:58

The install date is stored in the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate as UNIX time
 (32-bit value containing the number of seconds since 1/1/1970).
 

For more info get it at :
http://blogs.technet.com/b/askperf/archive/2012/02/17/useful-wmic-queries.aspx
http://theinterw3bs.com/wiki/index.php?title=WMIC_Commands
http://travisaltman.com/one-liner-commands-for-windows-cheat-sheet/

Monday, April 1, 2013

MS Outlook Data File (*.pst) Location in NTUSER.DAT

MS Outlook Data file (*.pst) location in NTUSER.DAT
HKEY_CURRENT_USER\Software\Microsoft\Office\[versionNumber]\Outlook\Catalog


Sample:
MS Outlook 2007
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Catalog

MS Outlook 2010
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Search
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Search\Catalog

Other Location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\PST

Friday, March 22, 2013

EnCase Date Formats:

Encase reports these dates in the following manner as below:-

Windows "File Created" = EnCase  “File Created”
Windows "File Modified" = Encase “Last Written”
Windows "File Accessed" = EnCase  “Last Accessed”
Windows "MTF last written" = Encase “Entry Modified”
Windows "INFO2 file deleted date/time" = Encase "File Deleted"


Source URL:
http://whereismydata.wordpress.com/2009/04/10/forensics-what-does-entry-modified-mean-in-encase/

http://whereismydata.wordpress.com/2009/02/14/dates-ntfs-created-modified-accessed-written/

https://whereismydata.wordpress.com/tag/entry-modified/

Tuesday, September 11, 2012

Location of Browser Data

Extract from this URL :  http://kb.digital-detective.co.uk/display/NetAnalysis1/Location+of+Browser+Data

Microsoft Internet Explorer
Microsoft Windows XP
Cookies
C:\Documents and Settings\{user}\Cookies\index.dat

History
C:\Documents and Settings\{user}\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\{user}\Local Settings\History\History.IE5\MSHist01YYYYMMDDYYYYMMDD\index.dat

Cache
C:\Documents and Settings\{user}\Local Settings\Temporary Internet Files\Content.IE5\index.dat

Other
C:\Documents and Settings\{user}\IETldCache\index.dat
C:\Documents and Settings\{user}\PrivacIE\index.dat
C:\Documents and Settings\{user}\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
C:\Documents and Settings\{user}\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\index.dat

Microsoft Windows Vista / 7
AppData\Local\Microsoft
C:\Users\{user}\AppData\Local\Microsoft\Feeds Cache\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat

AppData\Local\Microsoft\Windows\History
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist01YYYYMMDDYYYYMMDD\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat

AppData\Local\Microsoft\Windows\Temporary Internet Files
C:\Users\{user}\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\{user}\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat

AppData\Local\Temp\Low
C:\Users\{user}\AppData\Local\Temp\Low\Cookies\index.dat
C:\Users\{user}\AppData\Local\Temp\Low\History\History.IE5\index.dat
C:\Users\{user}\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\index.dat

AppData\LocalLow
C:\Users\{user}\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat

AppData\Roaming
C:\Users\{user}\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\IETldCache\Low\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat
C:\Users\{user}\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\index.dat

Apple Safari

Microsoft Windows XP

History
C:\Documents and Settings\{user}\Application Data\Apple Computer\Safari\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Apple Computer\Safari\
Microsoft Windows Vista / 7

History
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\

Cache
C:\Users\{user}\AppData\Local\Apple Computer\Safari\

Apple Macintosh OS X 10.6

History
/Users/{user}/Library/Safari/
Cache
/Users/{user}/Library/Caches/com.apple.Safari/

Mozilla Firefox
Microsoft Windows XP

History and Downloads
C:\Documents and Settings\{user}\Application Data\Mozilla\Firefox\Profiles\{profile folder}\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Mozilla\Firefox\Profiles\{profile folder}\Cache\

Microsoft Windows Vista / 7

History and Downloads
C:\Users\{user}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile folder}\
Cache
C:\Users\{user}\AppData\Local\Mozilla\Firefox\Profiles\{profile folder}\Cache\

Apple Macintosh OS X 10.6

History and Downloads
/Users/{user}/Library/Application Support/Firefox/Profiles/{profile folder}/

Cache
/Users/{user}/Library/Caches/Firefox/Profiles/{profile folder}/Cache/

GNU / Linux
History and Downloads
/home/{user}/.mozilla/firefox/{profile folder}/
Cache
/home/{user}/.mozilla/firefox/{profile folder}/Cache/

Google Chrome
Microsoft Windows XP
History
C:\Documents and Settings\{user}\Local Settings\Application Data\Google\Chrome\User Data\Default\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\

Microsoft Windows Vista / 7

History
C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default\
Cache
C:\Users\{user}\AppData\Local\Google\Chrome\User Data\Default\Cache\


Apple Macintosh OS X 10.6
History
/Users/{user}/Library/Application Support/Google/Chrome/Default/
Cache
/Users/{user}/Library/Caches/Google/Chrome/Default/Cache/


GNU / Linux
History
/home/{user}/.config/google-chrome/Default/
Cache
/home/{user}/.cache/google-chrome/Default/Cache/

Opera Browser
Microsoft Windows XP
History
C:\Documents and Settings\{user}\Application Data\Opera\Opera\
Cache
C:\Documents and Settings\{user}\Local Settings\Application Data\Opera\Opera\cache\

Microsoft Windows Vista / 7
History
C:\Users\{user}\AppData\Roaming\Opera\Opera\
Cache
C:\Users\{user}\AppData\Local\Opera\Opera\cache\

Apple Macintosh OS X 10.6
History
/Users/{user}/Library/Opera/
Cache
/Users/{user}/Library/Caches/Opera/cache/

GNU / Linux
History
/home/{user}/.opera/
Cache
/home/{user}/.opera/cache/