A few months ago, I released a new version of BrowsingHistoryView that extracted the history of Internet Explorer 10 from the locked WebCacheV01.dat (or WebCacheV24.dat) database file by using the ‘Volume Shadow Copy’ service.
The previous solution was not very successful, because it required full admin rights, it was very slow, and it also tend to fail on some systems.
The new version of BrowsingHistoryView (v1.30) provides much better solution to read the locked database of IE10. It locates the process that maintains the opened file, duplicates the file handle, and then uses the duplicated handle to copy the content of the locked database to into a temporary file. BrowsingHistoryView reads the history from the created temporary file and then deletes the temporary file.
So far, in all my tests, this method works very smoothly and it doesn’t require to run BrowsingHistoryView as admin.
If you have Internet Explorer 10, you are welcomed to download and test the new version of BrowsingHistoryView from this Web page.
Jennifer Burch says:
I’m trying to do something similar. First, I try to just do a regular copyfile(), if that fails I get the process, duplicate the handle and (overlapped) read from the file. Sometimes when the read occurs, DllHost.exe crashes, but my app still successfully copies the file.
Did you run into anything similar?
I’ve run your app as well and have never seen dllhost.exe crash with it.
August 20, 2013, 12:41 pmErem says:
Sounds promising. Does this mean a new version of IECacheViewer is on its way too? Thanks anyway for telling me where the cache is stored now, even though I can’t view it yet. Every other site I’ve looked at (including Microsoft’s!) has misdirected me to \Users\[UserName]\AppData\Local\Microsoft\Windows\Temporary Internet Files.
August 26, 2013, 10:50 am