ie-index-file

Parses Internet Explorer's index.dat file (MSIECF format) and queries the cache and visit history. Converts URL, file name, access time, modification time, and other information into structured fields for output.

Command properties

Property	Value
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

ie-index-file [zippath=STR] [zipcharset=STR] FILE_PATH

Options

zippath=STR: Path to the ZIP file containing the index.dat file. Use this when querying a file directly from inside a ZIP archive.
zipcharset=STR: Character set for ZIP file entries. (Default: utf-8)

Target

FILE_PATH: Path to the Internet Explorer index.dat file to query. You can use wildcards (*) to specify multiple files. The index.dat file is the cache file format used by Internet Explorer on Windows XP and earlier, typically located at C:\Documents and Settings\<username>\Local Settings\Temporary Internet Files\Content.IE5\index.dat.

Output fields

Field	Type	Description
`_file`	string	Original file name
`_time`	timestamp	Record timestamp
`type`	string	Record type, such as `URL`
`location`	string	Cached or visited URL
`file_name`	string	Cached file name
`last_accessed`	timestamp	Last access time
`last_modified`	timestamp	Last modification time

Error codes

Parsing errors

N/A

Runtime errors

Error code	Message	Description	Action on error
-	cannot read MSIE cache file PATH	The `index.dat` file could not be read or parsed	Aborts query execution

Description

The ie-index-file command parses index.dat files in MSIECF (Microsoft Internet Explorer Cache File) format used by Internet Explorer. This file was used by Internet Explorer on Windows XP and earlier to store web cache, cookies, and visit history.

URL records inside the file are parsed to output accessed URLs, cached file names, and timestamp information.

Examples

Query an index.dat file
```
ie-index-file /opt/logpresso/evidence/index.dat
```
Queries all records from the index.dat file at the specified path.
Filter visit history for a specific domain
```
ie-index-file /opt/logpresso/evidence/index.dat
| search location == "*example.com*"
```
Filters only cache or visit history entries matching a specific domain.
Query an index.dat file inside a ZIP archive
```
ie-index-file zippath=/opt/logpresso/evidence/artifacts.zip Content.IE5/index.dat
```
Queries records from the index.dat file inside the ZIP archive.