Windows internet history retrieval

i ahve been hired by someone to go through the internet history on their computer that was being used by one of their employees and find misuse (the employee stole $40,000 from the company and spent it on internet gambling)

it is likely that its ill all in the history and temporary internet files (i have not had a chance to look at it yet) but if the person isnt *completely* stupid then they will most likely have got rid of those, are there any other ways to retrieve history other than in teh documents and settings folder?

 

Browse around the Windows system directory (usually C:\WINNT, or C:\Windows) as Windows keeps a log of all files and internet traffic around there as well. I believe your looking for Temporary Internet files, temp, tmp, downloaded program files, etc. as well as the IE install folder.

The registry may also hold information, or keys that point to information as well.

Also getting an undelete utility that can scan through the partitions for deleted but overwritten data may uncover some of the temp files that were supposedly deleted. Sorry I don't know any tools in particualr, but I'm sure Google cna help with that one
Cheers mate.

 

im hoping that the person was a complete idiot (people seem to think she is) so hopefully they will be in amongst the other cached files and it will make my job very easy.

ill have to have a look round for some good software to do it as it would be worth me getting it for this if i can make it into a 10 min job for the money

didnt think about the registry ill have to have a look in there.

 

Before you do anything make a copy with ghost or something as if it is used for legal reasons then you are covered as they would say that by working on the machine you have tainted it. But if you work with the duplicate hard drive they can't say that. I did read an article on it not that long ago but just can't remember where.