Download Installation Files

Download Source Code

What is Dat File Viewer?

Simply put, this is a very light weight application that helps you see what all secrets microsoft is hiding in index.dat files in various folders under a user's profile. As per microsoft index.dat files are their cache or index files that they create to speed up access to various web sites, applications etc. But one thing lot of people have to come realize over the time that even after you clean up your Temporary Internet Files, Cookies, History etc. files from your windows machine, these index.dat files still carry all the footprints of your internet and file activities. So analysis of these files is used as one of the forensic tools when you want to recreate a user's internet activities in the past.

I am not going to go into details on format of index.dat files and other related technical details. Following link is an excellent technical resource on inside of index.dat file. This is by FoundStone.com a devision of McAfee.

• Index.dat White Paper

I have developed this open source application based on the original C code developed by FoundStone.com. This application is built using .Net framework.

Install It

• Download the insaller package associated with this post.
• Unzip this file in a folder.
• Double click on setup.exe to launch the installer.
• Follow the instructions and you are all set to go.

Pre-requisites

You will need to have Microsoft .Net Framework 4.0 installed on your machine to run this application. You can download the run time from the following location.

Download Microsoft .Net 4.0 Framework

I did not spend much time on the installer package to get automatic install of Microsoft .Net 4.0 framework. May be I will get to that in upcoming release. But for now, my apologies for making you do manual install of the framework if you do not already have it.

Run It

If you chose default installation option, you should have ByteBlocks Dat File Viewer entry in your start menu and you should be able to launch the applicaiton from there. If for some reason you do not see menu item in Start menu, then look under ProgramFiles/ByteBlocks folder the application. From there, you can double click on ByteBlocks.DatFileViewe.exe file to launch the application.

After you launch the application, you will see a splash screen with picture of a turtle in it. Depending on amount of data contained in your index.dat files, the application may require few seconds to load. So be little patient with load screen, the application will eventually load.

Export Results

The application allows you to export list of URLs or Coookies from following locations into a PDF file.

• Temporary Internet Files
• Cookies
• History

In the top menu of the application, click on Export > PDF link to generate PDF file.

Today I was testing an application on staging server before deployment to production server. One part of the application allows users to download dynamically generated PDF file. When I clicked on the link to download the file, I got the following error.

Unable to download UserFiles.aspx from www.foo.com.
Unable to open this Internet site.  The requested site is either unavailable
or cannot be found.  Please try again later.

I was not having any problem with this download on production site. First I thought it could be something in the server code that triggered it. I fired up fiddler and looked at the response. I could see the response has correct PDF content and file name that server generated. So as my routine diagnostic process of web application, I decided to try this on Chrome and FireFox instead of Internet Explorer. I was not too surprised to find that the download link worked perfectly. So it was browser related issue.

After digging through old Microsoft Knowledgebase articles, I found that back in IE6.0 days there was some issue with file downloads from SSL sites when cache-control header was set to no-cache or no-store etc. The KB mentioned that this issue was fixed. Just to make sure, I compared the response headers between working version and broken version, I realized that broken verion was sending headers with no-store, no-cahe set for Cache-Control.

--------- Production ----------
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/pdf
Compression-Control: whitespace
X-Powered-By: ASP.NET
Content-disposition: attachment; filename=538785069.pdf
Content-Length: 15379

----------------------- Testing ----------

HTTP/1.1 200 OK
Cache-Control: private,no-cache,no-store,max-age=0,
               must-revalidate,proxy-revalidate
Content-Type: application/pdf
Compression-Control: whitespace
X-Powered-By: ASP.NET
Content-disposition: attachment; filename=95736806.pdf
Content-Length: 28976
Pragma: no-cache

Then I realized that I have a compression software on server that compresses and adds some cache control headers as well. I turned off the caching headers for these PDF files and everything was back to normal. So much for fixed bug in IE6.0 that shows up in IE8.0.

With Windows 7 a lot of things have changed as far as location of certain folders go. In my previous post Location Of Documents and Settings Folder in Windows 7 I talked about how you can access your Documents And Settings Folder on Windows 7. Other day I was asked where has Temporary Internet Files folders have been moved.

There is an obvious answer to this question but lot of times we just forget about it. If you bring up Options dialog box from Tools menu or tool bar button, you can see location of this folder by clicking on Settings button. Following screen shots two steps that you need to follow to find location of your Temporary Internet Files folder location.

As a quick reference you will find Temporary Internet Files folder at following location.

This was just a nightmare experience with Java Run Time on Windows 7. I wanted to run live stock ticker application from my brokerage firm. That application is a java applet. For few years Microsoft has stopped installing JRE on Windows machines, thanks for litigation case with Sun MicroSystems. Anyways, I downloaded JRE from Sun's web site and installed it. First thing i notice is that when I launch Internet Explorer it taked 5-8 seconds for home page to come up. And subsequent page navigation is slow as well. When I looked in Task Manager I saw that ssvagent.exe process is consuming close to 90% CPU. Then I launched a second instance of browser. Now I have another ssvagent.exe process launched and consuming all the CPU it can. I could not surf any pages without waiting for 5-10 seconds per page load time. I immediately installed Java Run Time from my machine and everything back to normal.

I did some search about the process and found that this is some known issue. There is an official bug report about it on Sun's site as well. You can read about it on this link ssvagent.exe and jbroker.exe need to be signed. The bug has been opened and closed multiple times. And it looks that it still has not been fixed. At least now you do not get Windows UAC dialog box.

Few minutes ago I downloaded Silverlight 3 documentation as CHM file so I can read it while I am offline. After I unzipped the file, I launched it to view silverlight documentation. I could not view the help content. Instead I got the following error message in the details view.

Navigation to web page was cancelled

I knew what this error was because lot of my HTML Parser clients have run into this issue and I have given them the solution. But I never took time to post the solution on the site to settle it once and for all. This actually is not an error or there is nothing wrong with the file itself. You see this behavior because of one of security patches introduced in Windows XP. Because of a security hole, hackers were able to exploit CHM files to introduce malicious piece of code into user's machines. So now when you download a CHM file from internet, the operation system knows that it came from internet zone so it blocks opening of this file. Here are the steps you will need to follow to view any CHM file that you download from internet.

1. Right click on the file and bring up properties of the file. You will see the following message at the bottom of General Tab

   

2. Click on Unblock button. You will see that warning message become gray.
3. Click on Apply button and you are done.

You should be able to view the help file now.

Internet Explorer 8 is one of the good applications released by Microsoft recently. One of the points of contention and reason for legal troubles for Microsoft has been that Microsoft did not allow IE to be in-installed and change default search provider in the tool bar. Microsoft has allowed users to change search providers since last release of Internet Explorer. As it is user behavior that they don't change what is installed by default. If users want to use Google search provider they end up going to Google's site and then perform search. You really don't have to do that. You can simply change your search provider in Internet Explorer itself. Recently performance of FireFox has gone down the hill. So I have been using Firefox rarely. Once you know how you can change your search provider in Internet Explorer, you are all set. Here are simple steps that you can follow to add and user new search providers in Internet Explorer.

How to add new search provider in Internet Explorer browser

• Click on arrow pointing down next to search icon in search tool bar on top right side. Notice there is menu option to Find more providers...

  

• Click on that option and it will bring you to Add-ons Gallery: Search Providers. Here you will see list of search providers as show in image below.

  

• Pick the one that you want to use and click on Add to Internet Explorer button and you are done.
• Now click on down arrow next to search icon in search tool bar at top right as step one. And you will find the newly added search provider. For example my image shows Google provider added. Pick the one you want to use and Internet Explorer will switch to use that provider as default.