"!Janusware Total Recall" was written to give the computer user tools to reconstruct Internet Explorer activity and some user's activity on the computer.

Almost every computer user is familiar with a Web browser, such as Internet Explorer.

This Web browser holds the history files of the Web Sites (or Uniform Resource Locators - URLs) visited by users of this system. Because browser history files are in binary form, special tools are required to read them.

Internet Explorer caches URLs which were visited by users. When a user visits any Web Site, Internet Explorer checks to see if it has already stored (cached) a local copy of that Web Site on the hard drive first. If a local copy exists, Internet Explorer uses the locally cached file instead of downloading the information from the Internet. Internet Explorer stores cached files in the Temporary Internet Folders on the local hard drive. It also assigns each cached file an alphanumeric name, and maps the new filename to the actual filename in the system file. The system file used to map the cached alphanumeric names to the actual URLs and filenames is the index.dat file. Internet Explorer saves numerous files named "index.dat" within each user's home directory on the computer system. This file maps web sites visited to locally saved cache files in randomly named directories so that the next time the user visits the same web site, he will not have to download the same graphics and web pages all over again.

Now, our program investigates:

• MS Internet Explorer activity
• MS Internet Explorer history
• MS Internet Explorer cookie
• MS Internet Explorer favorites
• Recent files and folders
• Not erased temporary files