How do I see what has been erased in the history?
![]() |
How do I see what has been erased in the history?
Many applications on a PC maintain histories. It might make a difference which application you are referring to. On the other hand, if a machine is set to automatically delete history or a user deletes history, obtaining that information can be tough.
The computer does not erase the information, it simply deletes the file name and address making the sector(s) where the information was stored available for new information. If you take the computer to someone who does forensic computer analysis, there is a chance they can recover the information. There is a good chance they can get information from the last session, but if a hard drive has been written to several times since a file was stored and deleted, the information in that file might have been overwritten several times. In that case there is very little chance of recovering the information.
On the other hand, if the computer is part of a network, the history file might be saved in a central location. You'd have to talk with your IT department.
A much sneakier approach would be to get some computer geek to write a little program that sits on the computer of interest and makes a duplicate history file for the application of interest. Anyone who knows much about windows would be able to do this. Of course, this won't get past history... only future history.
All times are GMT -7. The time now is 05:05 AM. |