MSIE Cache File (index.dat) format.pdf

5/20/2018 MSIE Cache File (index.dat) format.pdf

1/44

MSIE Cache File (index.dat) format specification

Analysis of the index.dat file format

By Joachim Metz


2/44

Summary

The index.dat filename is used by Microsoft Internet x!lorer to cache different ty!es ofinformation. This s!ecification is based on the "or# by $J%&'()* and $+,-//0(* and "ascom!limented by re1erse engineering of the file format.

This document is intended as a "or#ing document for the M'I +ache 2ile 3M'I+24 s!ecification.5hich should allo" existing %!en 'ource forensic tooling to be able to !rocess this file ty!e.

!age i


3/44

Document information

Author(s): Joachim Metz

Abstract: This document contains information about the M'I +ache 2ile format.

Classification: ublic

Keywords: M'I +ache 2ile6 index.dat6 +lient 78/+ache MM2

License

Copyright (c) 2009-2013 Joachim Metz ermi!!io" i! gra"te# to copy$ #i!tri%&te a"#'or mo#iy thi! #oc&me"t &"#erthe term! o the *+ ,ree oc&me"tatio" ice"!e$ /er!io" 1.3 or a"y laterer!io" p&%li!he# %y the ,ree otare ,o&"#atio" ith "o 4"aria"t ectio"!$"o ,ro"t-Coer 5e6t!$ a"# "o 7ac8-Coer 5e6t!. copy o the lice"!e i!i"cle# i" the !ectio" e"title# :*+ ,ree oc&me"tatio" ice"!e:.

Version

Version Author Date Comments

(.(.0 J.B. Metz May 906 9((:May 996 9((:May 9)6 9((:May 9;6 9((:

Initial 1ersion.

(.(.9 J.B. Metz June 0)6 9((: -dditional information about date and time 1alues.(.(.) J.B. Metz June 06 9((:

June 9(6 9((:-dditional information about lea# records.

(.(.; J.B. Metz June 9=6 9((: -dditional information about %M'tore cache file.

(.(.? J.B. Metz 'e!tember 096 9((: -dditional information about file format.

(.(. J.B. Metz %ctober 0)6 9((:%ctober 06 9((:

'mall corrections.

(.(.= J.B. Metz %ctober 9;6 9((: -dditional information about file format.

(.(. J.B. Metz -ugust 9(0( mail change.

(.(.: J.B. Metz 'e!tember 9(0( -dditional information about M'I : beta.

(.(.0( J.B. Metz -ugust 9(09 mail and license u!date.

(.(.00 J.B. Metz January 9(0) -dditional information about file format.

(.(.09 J.B. Metz March 9(0) 'mall changes.

(.(.0) J.B. Metz March 9(0) -dditional findings regarding M'I ;.

(.(.0; J.B. Metz -!ril 9(0) -dditional findings regarding the header data6 hashingalgorithm and grou!s.

(.(.0? J.B. Metz June 9(0) -dditional information regarding o"nload 78/ record data"ith than#s to -. +ase.

!age ii


4/44

Table of Contents

0. %1er1ie"...........................................................................................................................................00.0. Aersions....................................................................................................................................00.9. 2ile ty!es and locations.............................................................................................................0

0.9.0. M'I ; on 5indo"s :....................................................................................................90.9.9. M'I ? on 5indo"s 9(((................................................................................................90.9.). M'I on 5indo"s '06 5indo"s 9(().................................................................90.9.;. M'I = on 5indo"s '9...........................................................................................90.9.?. M'I = on Aista................................................................................................................)0.9.. M'I on 5indo"s ')...........................................................................................;0.9.=. M'I on 5indo"s 9((................................................................................................;0.9.. M'I : on 5indo"s =......................................................................................................?

0.). Test 1ersion...............................................................................................................................9. 2ile header.........................................................................................................................................=

9.0. The cache directory table..........................................................................................................9.9. ,eader data...............................................................................................................................9.). The allocation bitma!................................................................................................................:

). ,ash table record..............................................................................................................................:).0. ,ash table entry........................................................................................................................:).9. 8ecord hash.............................................................................................................................0().). 8ecord hash flags....................................................................................................................0().;. ,ash algorithm........................................................................................................................00

;. 78/ record.....................................................................................................................................00;.0. 78/ record format 1ersion ;.=...............................................................................................00;.9. 78/ record format 1ersion ?.9...............................................................................................09;.). +ache entry flags.....................................................................................................................0?;.;. 78/ record ty!es....................................................................................................................0

;.;.0. +ache 78/ record data...................................................................................................0=;.;.9. Aisited 78/ record data.................................................................................................0;.;.). Inri1ate 2iltering 78/ record data................................................................................9(;.;.;. +om!atibility 78/ record data.......................................................................................9(;.;.?. T/ 78/ record data.....................................................................................................9(;.;.. o"nload 78/ record data............................................................................................90

;.?. 7se of the filetime 1alues........................................................................................................9)?. 8edirected record............................................................................................................................9;. /ea# record.....................................................................................................................................9;=. 2-T date time.................................................................................................................................9?. &otes...............................................................................................................................................9

.0. +ache entry control flags........................................................................................................9.9. +oo#ie state flags....................................................................................................................9=.). +ache entry flags.....................................................................................................................9.;. ,eader data.............................................................................................................................9:.?. Crou!s and grou! list..............................................................................................................)(.. ,ash algorithm........................................................................................................................)0

-!!endix -. 8eferences.....................................................................................................................))-!!endix B. C&7 2ree ocumentation /icense................................................................................))

!age iii


5/44

1. OvervieThe M'I+2 3M'I +ache 2ile4 is used by Microsoft Internet x!lores to cache different ty!es ofinformation. There are M'I+2 named index.dat for multi!le uses6 some areD the Tem!orary Internet 2ilesE the ,istoryE

the +oo#iesE the 2eed +ache.

The M'I+2 is also #no"n as the 5I&I&T +ache.

These index.dat file are stored in the corres!onding directories.

- M'I+2 consist of the follo"ing distinguishable elementsD file header

cache directory list allocation bitma!

records hash record 78/ record redirected record lea# record

Characteristics Description

Byte order littleFendian

ate and time 1alues in both 7T+ and local time

+haracter string -'+II strings are stored in extended -'+II "ith a code!age.

7nicode strings are stored in 7T2F0 littleFendian "ithout the byte ordermar# 3B%M4.

1.1. Versions

There are multi!le 1ersion of the M'I+2 format.

MSIE !ersion MSIEC"!ersion

"ilename #emar$s

M'I ) 3)9Fbit4 7n#no"n mm9?.datmm0(9;.dat

9? byte record size0(9; byte record size

M'I ; ;.= index.dat 09 byte bloc# based record size

M'I ? to : ?.9 index.dat 09 byte bloc# based record size

This document mainly focuses on M'I+2 1ersions ;.= and ?.9.

1.2. File types and locations

The ,istory 3!eriodic4 in the follo"ing sections indicates both the ,istory 3daily4 and ,istory3"ee#ly4 M'I+2 file ty!es.

!age 0


6/44

1.!.1. MSIE " on #indos $%

%ype of MSIEC" file Characteristics

Tem!orary Internet 2iles 3+ache4 G5I&I8GHTem!orary Internet 2ilesHindex.dat

,istory 3global4 G5I&I8GH,istoryHindex.dat

,istory 3!eriodic4 G5I&I8GH,istoryHHM',ist(0yyyymmddyyyymmddHindex.dat

+oo#ies G5I&I8GH+oo#iesHindex.dat

1.!.!. MSIE & on #indos !'''


Tem!orary Internet 2iles 3+ache4 G7'88%2I/GH/ocal 'ettingsHTem!orary Internet2ilesH+ontent.I?Hindex.dat

,istory 3global4 G7'88%2I/GH/ocal'ettingsH,istoryH,istory.I?Hindex.dat

,istory 3!eriodic4 G7'88%2I/GH/ocal'ettingsH,istoryH,istory.I?HM',ist(0yyyymmddyyyymmddHindex.dat

+oo#ies G7'88%2I/GH+oo#iesHindex.dat

7ser data G7'88%2I/GH-!!lication ataHMicrosoftHInternetx!lorerH7serataHindex.dat

1.!.. MSIE on #indos *+ S+1, #indos !''






7ser data G7'88%2I/GH7serataHindex.dat

1.!.". MSIE - on #indos *+ S+!



,istory 3global4 G7'88%2I/GH/ocal

!age 9


7/44


'ettingsH,istoryH,istory.I?Hindex.dat



2eeds +ache G7'88%2I/GH/ocal 'ettingsH-!!licationataHMicrosoftH2eeds +acheHindex.dat


1.!.&. MSIE - on ista


Tem!orary Internet 2iles 3+ache4 G7'88%2I/

GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH+ontent.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH/o"H+ontent.I?Hindex.dat

,istory 3global4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I

?Hindex.dat,istory 3!eriodic4 G7'88%2I/

GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?HM',ist(0yyyymmddyyyymmddHindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I?HM',ist(0yyyymmddyyyymmddHindex.dat

+oo#ies G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesH/o"Hindex.datG7'88%2I/GH-!!ataH/ocalHTem!H/o"H+oo#iesHindex.dat

7ser data G7'88%2I/GH-!!ataH8oamingHMicrosoftHInternetx!lorerH7serataHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftHInternetx!lorerH7serataH/o"Hindex.dat

2eeds +ache G7'88%2I/GH-!!ataH/ocalHMicrosoftH2eeds+acheHindex.dat

!age )


8/44

1.!.. MSIE % on #indos *+ S+







Inri1ate 2iltering G7'88%2I/GHri1acIHindex.dat

+om!atibility +ache

T/ +ache G7'88%2I/GHITld+acheHindex.dat2eeds +ache G7'88%2I/GH/ocal 'ettingsH-!!lication

ataHMicrosoftH2eeds +acheHindex.dat

%M store G7'88%2I/GH/ocal 'ettingsH-!!licationataHMicrosoftHInternet x!lorerH%M'toreHindex.dat

1.!.-. MSIE % on #indos !''%


Tem!orary Internet 2iles 3+ache4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH+ontent.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH/o"H+ontent.I?Hindex.dat

,istory 3global4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I?Hindex.dat

,istory 3!eriodic4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?HM',ist(0yyyymmddyyyymmddHindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I?HM',ist(0yyyymmddyyyymmddHindex.dat

+oo#ies G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesHindex.datG7'88%2I/

GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesH/o"Hindex.

!age ;


9/44


datG7'88%2I/GH-!!ataH/ocalHTem!H/o"H+oo#iesHindex.dat

7ser data G7'88%2I/GH-!!ataH8oamingHMicrosoftHInternet

x!lorerH7serataHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftHInternetx!lorerH7serataH/o"Hindex.dat

Inri1ate 2iltering G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHri1acIHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHri1acIH/o"Hindex.dat

+om!atibility +ache G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHI+om!at+acheHind

ex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHI+om!at+acheH/o"Hindex.dat

T/ +ache G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHITld+acheHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHITld+acheH/o"Hindex.dat


%M store G7'88%2I/GH-!!ataH/ocalHMicrosoftHInternetx!lorerH%M'toreHindex.datG7'88%2I/GH-!!ataH/ocal/o"HMicrosoftHInternetx!lorerH%M'toreHindex.dat

1.!.%. MSIE $ on #indos -


Tem!orary Internet 2iles 3+ache4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH+ontent.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sHTem!orary Internet2ilesH/o"H+ontent.I?Hindex.dat

,istory 3global4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?Hindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I?Hindex.dat

!age ?


10/44


,istory 3!eriodic4 G7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH,istory.I?HM',ist(0yyyymmddyyyymmddHindex.datG7'88%2I/GH-!!ataH/ocalHMicrosoftH5indo"sH,istoryH/o"H,istory.I?HM',ist(0yyyymmddyyyymmddHindex.dat

+oo#ies G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sH+oo#iesH/o"Hindex.dat

7ser data G7'88%2I/GH-!!ataH8oamingHMicrosoftHInternetx!lorerH7serataHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftHInternetx!lorerH7serataH/o"Hindex.dat

Inri1ate 2iltering G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHri1acIHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHri1acIH/o"Hindex.dat

+om!atibility +ache G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHI+om!at+acheHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHI+om!at+acheH/o

"Hindex.dat

T/ +ache G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHITld+acheHindex.datG7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHITld+acheH/o"Hindex.dat


%M store G7'88%2I/GH-!!ataH/ocalHMicrosoftHInternet

x!lorerH%M'toreHindex.datG7'88%2I/GH-!!ataH/ocal/o"HMicrosoftHInternetx!lorerH%M'toreHindex.dat

o"nload history G7'88%2I/GH-!!ataH8oamingHMicrosoftH5indo"sHIo"nload,istoryHindex.dat

1.3. Test version

The follo"ing 1ersion of !rograms "ere used to test the information "ithin this documentD M'I ;6 ?6 6 =6 6 :

!age


11/44

!. File headerThe file header is of =9 bytes of size and consists ofD

offset si&e !alue description

( 9 +lientHx9(7rl+acheHx9(MM2Hx9(AerHx9(.Hx((

The signature and 1ersion string-'+II string "ith an endFofFstringcharacterThe characters contain the major andminor 1ersions.

9 ; The file size

)9 ; The first hash table record offsetThe file offset to the first !art of the hashtableThis 1alue al"ays should be a multitude

of 09 and greater eKual (x;((( or ( ifno hash table is a1ailable.

) ; The total number of bloc#s

;( ; The number of allocated bloc#s

;; ; ( 7n#no"nm!ty 1alue

; ; The cache size 3Kuota4 limit of thecontainer+ontains the number of bytes

?9 ; ( 7n#no"nm!ty 1alue or ;Fbit extension of!re1ious 1alue

? ; The cache size of the container+ontains the number of bytes

( ; ( 7n#no"nm!ty 1alue or ;Fbit extension of!re1ious 1alue

; ; The nonFreleasable cache size of thecontainer. 3The size of the cache

container exem!t from sca1enging4+ontains the number of bytes

; ( 7n#no"nm!ty 1alue or ;Fbit extension of!re1ious 1alue

The container is the cache container e.g. the files in the corres!onding cache directories.

&oteD +an the signature and 1ersion string be set in the registryL Is it 1ariable of lengthL %r is 9bytes the maximum lengthL

!age =


12/44

2.1. The cache directory table

The file header is follo"ed by the cache directory table.

The cache directory table is 1ariable of size and consists ofD


=9 ; &umber of cache directory entries- maximum of )9 L

= ... +ache directory entries

The cache directory entry is 09 bytes of size and consists ofD


( ; The number of cached files in thedirectory

; +ache directory name

-'+II string "ithout an endFofstringcharacter

&ote that a cache directory can contain files besides the cached files.

2.2. Header data

The cache directory table is follo" by the header data "hich is an array of )9 x )9Fbit 1alues.


;( 3(x0cc4 ; 7n#no"n(a (( (( ((

;; ; 7n#no"n(9 (( (( (((; (( (( ((:f (( (( ((

; ; 7n#no"n(; (( (( ((c? (? (( ((d9 (( (( ((

;=9 7n#no"nm!ty 1alues

;( ; 7n#no"n( ;( (( ((

;; ...

? ; 7n#no"nm!ty 1alues

!age


13/44

2.3. The allocation bitmap

The allocation bitma! is situated at offset ?:9 3(x9?(4. The allocation bitma! continues to offset0); 3(x;(((4 but only the number of bytes necessary for the file size is used.

1ery bit re!resents a bloc# of 09 byte 3(x(4 starting at the 3base4 offset (x;(((. The bitma! isstored byteF"ise "here the /'B refers to the lo"est offset6 e.g.%a!e o!et ; 06000ir!t allocatio" %itmap %yte ; 060&"allocate# ra"ge ; 06000 = 06200allocate# ra"ge ; 06200 - 0600

. /ash table recordThe hash table record consists ofD the hash table header hash table entries

The hash table record is ;(: bytes of size.

The hash table header is 0 bytes of size and consist ofD


WININET FILEMAP_ENTRY

( ; ,-',N The signature

; ; )9 3(x9(4 The number of bloc#s in hash tableThe bloc# size is 09 bytes

)9 x 09 O ;(:This 1alue includes the size of the hashtable headerThe hash table entry data size isD;(: P 09 O ;(;

WININET LIST_FILEMAP_ENTRY

; &ext hash table record offsetThe file offset to the next !art of the hashtable or ( if this is the last !art of the hashtable

09 ; The seKuence number( identifies the first hash table record

3.1. Hash table entry

The hash table entry 3,-',ITM4 is bytes of size and consists ofD


( ; 8ecord hash

; ; 8ecord offset

This 1alue al"ays should be a multitude

!age :


14/44


of 09 and greater eKual (x;(((If the record offset contains the same1alue as the record hash the 1alue isunused

,ash table entries that contain the same record hash and offset seem to be unused.

3.2. Record hash

The record hash is )9Fbits of size and consists ofD


(.( ? bits 8ecord hash flags

(.? 0 bit 7nused

(. 9 bits 8ecord hash 1alue

The record hash can contain different 1aluesD

Value Description

(x( Aalid 78/ record

(x(((((((0 In1alid 78/ record'ome of the record offsets might be still 1alid

(x((((((() un#no"n recordonly seen as unusedD "ith a record offset of (x((((((()

(x? 88 record

(x(badf((d ,ash table entry is uninitialized

(xdeadbeef ,ash table entry is uninitialized 3M'I 4

The uninitialized hash table entries can occur in all hash table records not only the last one. %ften thehash tables are only filled to offset (xe(( L

The 1alid 78/ records in the hash table do not refer to all the allocated 78/ records in the file.

Maybe the record hash refers to a buc#et of records not a single record.

3.3. Record hash flags

Value Description

(x(0 ntry is unused

(x(9 ntry is loc#ed

(x(; ntry is redirected 3!oint to a 88 record4

(x( ntry is !art of grou!

(x0( ntry is !art of a list of grou!s

!age 0(


15/44

3.4. Hash algorithm

T%%

". 02 record

The 78/ record re!resents a cached entry. $J%&'()* refers to this record as the 78/ acti1ityrecord.

4.1. UR record format version 4.!

The 78/ record 1ersion ;.= 378/2I/M-&T8Q4 is 1ariable of size and consists ofD



( ; 78/Hx9(N The signature

; ; The number of bloc#s in 78/ recordThe bloc# size is 09 bytes

The secondary time 1alue2iletime+ontains ( if not set'ee sectionD ;.? 7se of the filetime 1alues

0 The !rimary time 1alue2iletime+ontains ( if not set'ee sectionD ;.? 7se of the filetime 1alues+an contain (x=fffffff (xffffffff

9; x!iration date and time2iletime+ontains ( if not set

)9 ; +ached file size+ontains the number of bytes

) 09 7n#no"nm!ty 1alues

; ; 7n#no"nm!ty 1alues

?9 ; 7n#no"n

? ; 0(; 3(x((4 The location offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

( 0 +ache directory index- 1alue of ( re!resents the first cachedirectory

0 ) 7n#no"n

!age 00


16/44


; ; The filename offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

; +ache entry flags

=9 ; The data offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

= ; The data size

( ; 7n#no"nm!ty 1alues

; ; /ast chec#ed date and time3/ast synchronization date and time42-T date time+ontains ( if not set'ee sectionD = 2-T date time

; &umber of hits

:9 ; 7n#no"nm!ty 1alues7se count used in memoryL

: ; 7n#no"n/ast cache synchronization date and time2-T date time+ontains ( if not set

'ee sectionD = 2-T date time0(( ; 7n#no"n

m!ty 1alues

URL record data variable of size

3location offset40(;

... The location-'+II string "ith an endFofFstringcharacter'!ecial characters are 78/ encoded3; byte aligned4

3filename offset4 ... The filename in cache directory

-'+II string "ith an endFofFstringcharacter

3data offset4 3data size4 ata

... ... 7n#no"n7ninitialized

4.2. UR record format version ".2

The 78/ record 1ersion ?.9 3I?78/2I/M-&T8Q or I78/2I/M-&T8Q4 is

1ariable of size and consists ofD

!age 09


17/44



( ; 78/Hx9(N The signature


The secondary time 1alue2iletime+ontains ( if not set'ee sectionD ;.? 7se of the filetime 1alues

0 The !rimary time 1alue2iletime+ontains ( if not set'ee sectionD ;.? 7se of the filetime 1alues

9; ; x!iration date and time2-T date time+ontains ( if not set'ee sectionD = 2-T date time+an contain (xffff (xffff 3seen in a Aisited78/ record "ith an aboutD 78I4F0 O> ne1er

9 ; 7n#no"nm!ty 1alues

)9 ; +ached file size

+ontains the number of bytes) ; 7!!er !art of a ;Fbit cached file size

+ontains the number of bytes

;( ; Crou! or grou! list offset

;; ; The nonFreleasable time delta3exem!t time delta4+ontains the number of seconds

+ontains the number of seconds beforethe cached item may be released. The

time delta is relati1e to the last accesstime. %ften it contains the 1alue ;((3(x(((0?0(4 seconds or 9; hours.

; ; : 3(x(((4 7n#no"n offsetThe 1alue is relati1e to the start of the78/ record

?9 ; 0(; 3(x((4 The location offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

? 0 +ache directory index

- 1alue of ( re!resents the first cache

!age 0)


18/44


directory

(xfe O> s!ecial ty!e3coo#ieRiecom!atRiedo"nload4L(xff O> L&oteD - 1alue of (x22 could be a s!ecialflag. There is no associated file in thecache and the 78/ has the a S.cdfextension. +ould be +hannel efinition2iles.

?= 0 7n#no"n 3synchronization count4(x(( O>(x(0 O >(x(9 O>(x() O>

? 0 2ormat 1ersion(x(( O> I?78/2I/M-&T8Q(x0( O> I78/2I/M-&T8Q

?: 0 +o!y of format 1ersion(x(( O> I?78/2I/M-&T8Q(x0( O> I78/2I/M-&T8Q

( ; The filename offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

; ; +ache entry flags

; The data offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

=9 ; The data size

= ; 7n#no"n 3file extension offset4m!ty 1alues

( ; /ast chec#ed date and time3/ast synchronization date and time42-T date time

+ontains ( if not set'ee sectionD = 2-T date time

; ; &umber of hits3number of times the entry has beenloc#ed4

; 7n#no"nm!ty 1alues7se count used in memoryL3le1el of loc# nesting of the entry4

:9 ; 7n#no"n

/ast cache synchronization date and time

!age 0;


19/44


3entry creation timeL42-T date time+ontains ( if not set'ee sectionD = 2-T date time

URL record data variable of size3un#no"noffset4:

; 7n#no"n 1alue3 byte aligned4

0(( ; 7n#no"n7ninitialized

3location offset40(;

... The location-'+II string "ith an endFofFstringcharacter'!ecial characters are 78/ encoded

3 byte aligned4

3filename offset4 ... The filename in cache directory-'+II string "ith an endFofFstringcharacter

3data offset4 3data size4 ata


4.3. #ache entry flags

The cache entry flags consist of the follo"ing 1aluesD

Value Identifier Description

(x(((((((0 &%8M-/+-+,&T8Q &ormal cache entryE can be deleted to reco1ers!ace for ne" entries.

(x(((((((9 'T-B/+-+,&T8Q

(x(((((((; 'TI+Q+-+,&T8Q 'tic#y cache entry that is exem!t from sca1engingfor the amount of time s!ecified by release3exem!t4 delta. The default 1alue set by the

function +ommit7rl+achentry is one day.

,as extended flags 3un#no"n 1alue at offset ;(4D(x((((;(( L

(x((((((( IT+-+,&T8Q +ache entry file that has been edited externally. Thiscache entry ty!e is exem!t from sca1enging.'et for iecom!atD and T/ +ache entries

(x((((((0( T8-+%22/I&+-+,&T8Q

&ot currently im!lemented.

(x((((((9( T8-+%&/I&+-+,

&T8Q


!age 0?


20/44


(x((((((;( Is cachedRcacheFableL&ot set if header contains ragmaD noFcacheN orother cache related headers are !resent

(x((((0((( ,TT reKuest method( O> CT0 O> %'T

(x(((0(((( '-8'+-+,&T8Q artial res!onse cache entry.

(x(((9(((( %++-+,&T8Q %/ +ontrol xtension 3%+4 cache entry.%+ is a !redecessor of -cti1e'et for ri1acID

(x((0((((( +%%I+-+,&T8Q +oo#ie cache entry.

(x((9((((( 78/,I'T%8Q+-+,&T8Q

Aisited lin# cache entry.

(x((;((((( &I&C/T+-+,&T8Q

+ache entry is !ending deletion.

(x0((((((( I&'T-//+-+,&T8Q

7n#no"n

(x((((((( I&TITQ+-+,&T8Q 7n#no"n

4.4. UR record types

The 78/ record 1alues ha1e different meanings for different ty!es of M'I+2 files.

%ype of MSIEC" file 'ocation:

Tem!orary Internet 2iles 3+ache4

,istory 3global4 AisitedD @

,istory 3!eriodic4 DD @

ate range is formatted asDyyyymmddyyyymmdd

5hat about ,ostD in the 1isited 78I e.g.D9(0)(00(9(0)(000D test@D,ostD My +om!uterD9(0)(0(:9(0)(00(D test@fileDRRR+DRtest.txt

+oo#ies +oo#ieD@

Inri1ate 2iltering ri1acID

+om!atibility +ache iecom!atD

!age 0


21/44

%ype of MSIEC" file 'ocation:

T/ +ache ietldD

2eeds +ache feed!latD

7ser data userdataD@@

%M store %M'toreDo"nload history iedo"nloadD

&ote both ,istory 3global4 and ,istory 3!eriodic4 set 78/,I'T%8Q+-+,&T8Q but globalsets 'TI+Q+-+,&T8Q and !eriodic sets 'TI+Q+-+,&T8Q.

-ccording to $B7&TI&C* the ,istory 3global4 78/ record ty!e containsD


22/44

Co"te"t-e"gth; 221BMCo"te"t-5ype; image'6-ico"BMD5ag; :931c9030e22EcE1;2G:BMH-+-Compati%le; 4DKDm&late4DFBMH-oere#-7y; .*D5BMBM+;&!er"ameBM

flags: 0x00001001?55'1.0 200 ABM3; CK:*4 D/o 54a + 7+:BMH-,&"ctio"; 101BMragma; "o-cacheBMCo"te"t-5ype; applicatio"'6-jaa!criptBMCo"te"t-e"gth; 209BMBM+;&!er"ameBM

?55'1.0 200 ABM3; CK:** *4 a a + 4* +*4 CM */ 5:$policyreK:'3c'p3p.6ml:BM

3; CK:** *4 a a + 4* +*4 CM */ 5:$policyreK:'3c'p3p.6ml:BMD5ag; :c9e0-2%-2Ga3FG:BMCo"te"t-e"gth; 3BMCo"te"t-5ype; image'giBMBM+;&!er"ameBM

lag!; 060000101?55'1.1 200 ABMCo"te"t-5ype; te6t'html char!etK+5,-GBM5ra"!er-D"co#i"g; ch&"8e#BMBM+;&!er"ameBM

?55'1.1 200 ABMCo"te"t-5ype; te6t'html char!etK&t-GBM3; CK: 4* C M C*o C+ C+o 4/o 4/o 54 5Do + MoC*5 CM 4*5 */ * ?L D + +*4:BMH-oere#-7y; .*D5BMH-+-Compati%le; 4DKDm&late4DFBMH-!p*et-/er!io"; 2.0.0F2FBM5ra"!er-D"co#i"g; ch&"8e#BMBM+;&!er"ameBM

".".!. isited 02 record data

The 1isited 78/ record contains information "hich user 1isited "hat 78I.

The 78/ record location consists of the follo"ing string/i!ite#;


23/44


9 0 The entry ty!e

) 0 The 1alue ty!e

; 3entry size F ;4 Aalue data

The last entry is an em!ty entry consisting of ; zeroFbytes.

Entry type Value type Identifier Description

(x(9 (x(( 7n#no"n

(x(e (x0e 7n#no"n- C7I formatted as a stringU((((((F((((F((((F((((F((((((((V"ith &7/ character

3? trailing em!ty bytes4

(x0( (x0f age title"ith &7/ characters3; trailing em!ty bytes4

(x00 (x(0 2ilenames'!ecial characters are 78/ encoded3; trailing em!ty bytes4

(x0; (x() 7n#no"n3; trailing em!ty bytes4

(x0? (x0e ,TT 78I of fa1icon"ith &7/ character3; trailing em!ty bytes4

(x0 (x0f 2ile 78I"ith &7/ characters'!ecial characters are 78/ encoded3; trailing em!ty bytes4

(x0= (x0) 7n#no"n

3; trailing em!ty bytes4

(x0 (x;( 7n#no"n+ontains a filetime3; trailing em!ty bytes4

(x0c (x() 7n#no"n3; trailing em!ty bytes4

(x0e (x;( 7n#no"n

+ontains a filetime

!age 0:


24/44

Entry type Value type Identifier Description

3; trailing em!ty bytes4

(x9( (x() 7n#no"n3; trailing em!ty bytes4

The 1alue ty!es are similar to the 1alues used by the %/ 1ariant ty!es 3AT4 and M-I data3!ro!erty4 ty!es 3T4D

Value type Identifier Description

(x(( ATMTQ m!ty

(x(0 Multi 1alue 7T2F0 stringL

(x() ATI; Integer )9Fbit signed

(x0e AT/'T8 xtended -'+II string&7/ terminated

(x0f AT/5'T8 7nicode string 37T2F0 littleFendian4&7/ terminated

5hat about the first entry it has an em!ty 1alue ty!e but contains 1alues.erha!s itWs some #ind of headerL It is !resent in e1ery 1alidation data.first )9Fbit 1alue containsD(( (( (( (( (( (( (( (( (( (( (( (( 3( or 0 entries4

(( (( (( 0( (( (( (( (( (( (( (( (( 3( or 0 entries4(( (( (( 0( (( (( (( (( (0 (( (( (( 3multi!le entries4(( (( (( 0( (( (( (( (( () (( (( (( 3multi!le entries4

".".. In+rivate Filterin3 02 record data

data does not change bet"een itemsli%m!iec&rlrea#; #ata;00000000; 1 00 00 01 00 00 00 0 00 00 00 G1 1 33 21 ........ .....3N00000010; 00 00 00 00

".".". Compatibilit4 02 record data

data does not change bet"een itemsli%m!iec&rlrea#; #ata;00000000; G 9 F1 1F 00 00 0G 00 00 00 00 00 H4I..... ....

".".&. T25 02 record data

data does not change bet"een itemsli%m!iec&rlrea#; #ata;

!age 9(


25/44

00000000; 01 00 00 00 01 00 00 00 00 00 00 00 ........ ....

".".. 5onload 02 record data

If set the 78/ record data contains data in the follo"ing formatD

offset si&e !alue description( ; (x((((((? 7n#no"n

Aalue does not change6 maybe 1ersionindicator

; ; o"nload status(x(((((((0 O> in !rogressL(x((((((() O> !aused(x((((((( O> interru!ted(x(((((((b O> com!leted

7n#no"n 3m!ty 1alues4

0 ; 7n#no"nsometimes (

9( 0 C7I'hould match the C7I in the locationstring or ( if not set e.g. in canceleddo"nload

) o"nload start time2iletime

;; ; 7n#no"n 3m!ty 1alues4

; 7n#no"n

? ; 7n#no"n

( ; 7n#no"n

; ; 7n#no"n

; 7n#no"n

=9 Total do"nload sizeAalue in bytes

( If status is in !rogress

&umber of bytes do"nloadedL 7n#no"n

: 7n#no"n 3m!ty 1alues4

0(; 7n#no"n'et to 0 if string array contains acom!anyRorganization nameL

009 7n#no"n(x(

09( ; 2lags

(x(0 O> com!lete do"nload 3other"ise

!age 90


26/44


!artial4(x(9 O> un#no"n 3related to signinginfo4(x(; O> un#no"n 3related to signinginfo4(x( O> string array contains acom!anyRorganization name(x0( O> string array contains originating"ebsite 78/(x;( O> un#no"n 3related to signinginfo4

09; 0 7n#no"n 3m!ty 1alues4

0;( ; 7n#no"n'et to 0 if string array contains acom!anyRorganization nameL

0;; 9 7n#no"n9 O> ,TTR,TT'

0; 9 7n#no"n(x?((( ,TT

0; ; 7n#no"n 3hash or chec#sumL4not set for ft!

0?9 0?9 7n#no"n 3m!ty 1alues4

)(; 7n#no"n( most of the time also seen 0

)09 ... -rray of strings

oes the /ast cache synchronization date and time of the 78/ contain the do"nload time or is thisjust a common side effect of original !ur!ose of the date and time 1alueL

ie#o"loa#;OFDD0-00,9-11D2-GD,-F07E2D02,P

+4 relate# to +4 i" + locatio"Q,4D54MD (!ame a! primary timeQ ep 1F$ 2012 1G;F;2E.F19EE2000)#o"loa#e# ile !ize00000000; G 00 00 00 0% 00 00 00 00 00 00 00 00 00 00 00 ........ ........

00000010; e9 # 00 00 GG # 33 9 00 e2 11 Ge F0 a ....D.R3 .....pS00000020; %E 2 e0 2 cc Fe 99 F 0E 9 c# 01 00 00 00 00 .7.'.. ........

00000030; 91 01 00 00 00 00 00 00 01 00 00 00 01 00 00 00 ........ ........0000000; 00 00 00 00 01 00 00 00 2G cc 0 01 00 00 00 00 ........ (.......

0000000; 9 % 00 00 00 00 00 00 01 00 00 00 00 00 00 00 L....... ........000000E0; 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ........ ........000000F0; 0E 00 00 00 00 00 00 00 19 00 00 00 00 00 00 00 ........ ........000000G0; 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ........ ........00000090; 02 00 00 0 1F 0 0 1a ....@.. ........

00000090; 00 00 00 00 00 00 00 00 ....@.. ........

000000a0; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........

!age 99


27/44

000000%0; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........000000c0; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........000000#0; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........000000e0; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........0000000; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........00000100; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........00000110; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........

00000120; 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........00000130; 00 00 00 00 00 00 00 00 ........

Compa"y'rga"izatio" "ame00000130; # 00 E9 00 E3 00 F2 00 M.i.c.r.0000010; E 00 F3 00 E 00 EE 00 F 00 20 00 3 00 E 00 o.!.o.. t. .C.o.0000010; F2 00 F0 00 E 00 F2 00 E1 00 F 00 E9 00 E 00 r.p.o.r. a.t.i.o.000001E0; Ee 00 00 00 "...

+ #o"loa# origi"ati"g e%page000001E0; EG 00 F 00 F 00 F0 00 3a 00 2 00 h.t. t.p.;.'.000001F0; 2 00 FF 00 FF 00 FF 00 2e 00 E# 00 E9 00 E3 00 '.... ..m.i.c.000001G0; F2 00 E 00 F3 00 E 00 EE 00 F 00 2e 00 E3 00 r.o.!.o. .t...c.

...000001c0; FF 00 Ee 00 Ec 00 E 00 E1 00 E 00 2e 00 E1 00 .".l.o. a.#...a.000001#0; F3 00 F0 00 FG 00 00 00 !.p.6...

+ #o"loa#000001#0; EG 00 F 00 F 00 F0 00 h.t.t.p.000001e0; 3a 00 2 00 2 00 E 00 E 00 FF 00 Ee 00 Ec 00 ;.'.'.#. o..".l....000002c0; 2e 00 E# 00 F3 00 F 00 00 00 ..m.!.&. ..

e!ti"atio" ile"ame000002c0; 3 00 3a 00 c 00 C.;.T...

0000030; EG 00 0 00 E% 00 EF 00 2e 00 E# 00 F3 00 F 00 h..8.g. ..m.!.&.0000030; 00 00 ..

4.". Use of the filetime val$es

The filetime 1alues in the 78/ record ha1e different meanings for different ty!es of M'I+2 files.

%ype of MSIEC" file rimary time !alue Secondary time !alue

Tem!orary Internet2iles 3+ache4

+lient last accessed date and time in7T+

'er1er modification date and timein 7T+

,istory 3global4 /ast 1isited date and time in 7T+ /ast 1isited date and time in 7T+,istory 3"ee#ly4 ,istory creation date and time in 7T+

+ontains the creation date and time ofthe M'I+2 index.dat file

/ast 1isited date and time in localtimezone

,istory 3daily4 /ast 1isited date and time in 7T+ /ast 1isited date and time in localtimezone

+oo#ies +oo#ie last accessed date and time in7T+

+oo#ie modification date and timein 7T+

Inri1ate 2iltering 7T+ emt!y

+om!atibility +ache 7T+ emt!y

!age 9)


28/44

%ype of MSIEC" file rimary time !alue Secondary time !alue

T/ +ache 7T+ emt!y

2eeds +ache 7T+ emt!y

7ser data 7T+ mt!y

%M 'tore 7T+ mt!yo"nload history o"nloaded file creation time in 7T+

3do"nload start time4mt!y

&ote on 5indo"s = the M-.B times of the do"nloaded file are the same as the do"nloaded filecreation time.

&. edirected recordThe redirected record re!resents a redirected entry. $J%&'()* refers to this record as the 88

acti1ity record.

The redirected record is 1ariable of size and consist ofD



( ; 88N The signature

; ; The number of bloc#s in redirected recordThe bloc# size is 09 bytes

; Target hash table entry offsetThe offset is relati1e from the start of thefile3,o"e1er it does not seem to be thecorres!onding 78/ record6 !erha!s runFtime remnant data4

09 ; Target 78/ hash 1alue

0 ... The location-'+II string "ith an endFofFstringcharacter

. 2ea6 recordThe lea# record re!resents a cached 78/ record that is not longer consider as a 1alid !art of thecache but that "as not remo1ed. 'ee $+,-//0(* for a more detailed descri!tion.

The lea# record is 1ariable of size and consist ofD



( ; /-N The signature

!age 9;


29/44



9; 7n#no"n

7ninitialized

)9 ; +ached file size in bytes

) 7n#no"n7ninitialized

;; ; &ext lea# record offsetThe offset is relati1e from the start of thefile

; 7n#no"n7ninitialized

? 0 +ache directory index- 1alue of ( re!resents the first cachedirectory

?= ) 7n#no"n7ninitialized

( ; The filename offsetThe 1alue is relati1e to the start of the78/ record or ( if not set

; 9; 7n#no"n7ninitialized

; 7n#no"nm!ty 1alues

:9 ; 7n#no"n/ast cache synchronization date and time2-T date time+ontains ( if not set'ee sectionD = 2-T date time

LEAK record data variable of size

: 7n#no"n

7ninitialized

3filename offset40(;

... The filename in cache directory-'+II string "ith an endFofFstringcharacter3 byte aligned4


!age 9?


30/44

-. F7T date timeThe 2-T date time consists of ; bytesD


( 9 date

9 9 time

In littleFendian the 0Fbit date 1alue corres!onds toD


Bit ( 3/'B4 ? bits ay of the month

Bit ? ; bits Month(x(0 O> January

Bit : = bits Qear(x(( O> 0:(

In littleFendian the 0Fbit time 1alue corres!onds toD


Bit ( 3/'B4 ? bits 'econdsin 9 second inter1als

Bit ? bits Minutes

Bit 00 ? bits ,ours

%. 8otesINTERNET_CACHE_ENTRY_INFO Structure defines 4 time stamps FILETIME LastModifiedTime FILETIME E!pireTime FILETIME LastAccessTime FILETIME LastS"ncTime

t"pedef struct _INTERNET_CACHE_TIMESTAM#S $ FILETIME ftE!pires FILETIME ftLastModified%INTERNET_CACHE_TIMESTAM#S& 'L#INTERNET_CACHE_TIMESTAM#S

%.1. #ache entry control flags


(x(((((((; +-+,&T8Q-TT8IB7T2+

'ets the cache entry ty!e.

(x((((((0( +-+,&T8Q,IT8-T2+

'ets the hit rate.

!age 9


31/44


(x((((((;( +-+,&T8QM%TIM2+

'ets the last modified time.

(x((((((( +-+,&T8QTIM2+

'ets the ex!ire time.

(x(((((0(( +-+,&T8Q-++TIM2+

'ets the last access time.

(x(((((9(( +-+,&T8Q'Q&+TIM2+

'ets the last sync time.

(x(((((;(( +-+,&T8Q,-8I&2%2+


(x((((((( +-+,&T8QMT/T-2+

'ets the exem!t delta.

%.2. #oo&ie state flags

The Internet+oo#ie'tate enumeration defines the state of the coo#ie.'yntax

ty!edef enum U +%%I'T-T7&&%5& O (x(6 +%%I'T-T-++T O (x06 +%%I'T-T8%MT O (x96 +%%I'T-T/-', O (x)6 +%%I'T-T%5&C8- O (x;6

+%%I'T-T8J+T O (x?6 +%%I'T-TM- O +%%I'T-T8J+TV Internet+oo#ie'tateE

+onstants

+%%I'T-T7&&%5&

8eser1ed.+%%I'T-T-++T

The coo#ies are acce!ted.+%%I'T-T8%MT

The user is !rom!ted to acce!t or deny the coo#ie.+%%I'T-T/-',

+oo#ies are acce!ted only in the firstF!arty context.+%%I'T-T%5&C8-

+oo#ies are acce!ted and become session coo#ies.+%%I'T-T8J+T

!age 9=


32/44

The coo#ies are rejected.+%%I'T-TM-

'ame as +%%I'T-T8J+T.

%.3. #ache entry flagsresDRR location filename flagsD (x(((((((0

htt!DRR location filename data 3string4 flagsD (x(((((((0 flagsD (x(((((((? 3,as un#no"n 1alue at offset ;(4 flagsD (x((((((;0 flagsD (x((((((;? 3,as un#no"n 1alue at offset ;(4 flagsD (x((((0((0 flagsD (x((((0(;0

+oo#ieD location filename flagsD (x((0((((0

AisitedD location data 3binary4 flagsD (x((9((((( flagsD (x((9((((0

ri1acID location data 3binary4 flagsD (x(((9(((; 3,as un#no"n 1alue at offset ;(4

iecom!atD location data 3binary4 flagsD (x(((((((:

ietldD location data 3binary4 flagsD (x(((((((:

feed!latD location

!age 9


33/44

filename data 3string4 flagsD (x(((((((0

userdataD location

filename flagsD (x(((((((0

iedo"nloadD location filename data 3binary4 flagsD (x(((((((:

%.4. Header data


;( ; number of changes to any of many5I&I&T settings3+-+,,-8-T-+788&T

'TTI&C'A8'I%&4

;; ; number of changes to container list forsame registry set3+-+,,-8-T-+%&/I'T+,-&C+%7&T4

; ; number of changes to +oo#ies container3+-+,,-8-T-+%%I+,-&C+%7&T4

;=9 ; "indo" handle for cache notifications3+-+,,-8-T-&%TI2I+-TI%&,5&4

;= ; "indo" message for cache notifications3+-+,,-8-T-&%TI2I+-TI%&M'C4

;( ; file offset of first C8%7&T8Q6 elsezero3+-+,,-8-T-8%%TC8%7%22'T4

;; ; lo" )9 bits for generation of mostrecently allocated C8%7I6 else zero3+-+,,-8-T-CI/%54

; ; high )9 bits for generation of mostrecently allocated C8%7I6 else zero

3+-+,,-8-T-CI,IC,

!age 9:


34/44


4

;:9 ;

;: ;

?(( ;?(; ;

?( ;

?09 ;

?0 ; +-+,,-8-T-''/'T-T+%7&T

?9( ;

?9;

(x0? +-+,,-8-T-&%TI2I+-TI%&2I/T8 bit flags to filter cachenotifications(x0 +-+,,-8-T-8%%T/-%22'T file offset of first lea#entry(x0B +-+,,-8-T-8%%TC8%7/I'T%22'T file offset of firstC8%7/I'T&T8Q6 else zero

%.". 'ro$ps and gro$p list

78/ record grou! list or grou! offsetset for htt!DRR "ith flags (x(((((((; set. The 1alue does not change for different items 3(x((((;((4-lthough the flag is set in some hostRfile it contains (x((((((((


( Crou! identifier( if grou! entry is not used6 F0 if grou!entry is an index entry

If ro!" ide#tifier $$ %&

; Crou! entry offsetThe offset is relati1e to the start of the fileor ( if not a1ailable

Else if ro!" ide#tifier '$ (

; Crou! flags

)o**o#

09 ; Crou! ty!e

0 is# usage

!age )(


35/44


Aalue in bytes

9; is# KuotaAalue in 0(9; bytes 3iB4

If ro!" ide#tifier $$ %&

; 2irst a1ailable 3free4 grou! entry offsetThe offset is relati1e to the start of the fileor ( if not a1ailable

Else if ro!" ide#tifier '$ (

; Crou! data offsetThe offset is relati1e to the start of the fileor ( if not a1ailable

)o**o#

+, 7n#no"n

m!ty 1alues


(x(0 +-+,C8%72/-C&%&78C-B/

(x(9 +-+,C8%72/-C2/7',78/%&/T

%ffset 'ize escri!tion

(x(( C8%7&-MM-/&CT, bytes grou! name(x= C8%7%5&8'T%8-C'IX d"ords o"ner storage(x d"ord in allocated entryD zeroin free entryD file offset of next free C8%7-T-&T8Q6 else zero

%.(. Hash algorithm

efine the hash !ad table asD&i"tGt ha!hpa#ta%leU 2E R K O 0601$ 060e$ 06Ee$ 0619$ 06E1$ 06ae$ 06G$ 06FF$

06Ga$ 06aa$ 06F#$ 06FE$ 061%$ 06e9$ 06Gc$ 0633$06F$ 06c$ 06%1$ 06E%$ 06ea$ 06a9$ 063G$ 06$061e$ 060F$ 06a#$ 069$ 06%c$ 062G$ 062$ 061$0631$ 06#$ 06EG$ 06%e$ 0639$ 06#3$ 069$ 06#$0630$ 06F3$ 060$ 0602$ 063$ 06%a$ 06#2$ 061c$060c$ 06%$ 06EF$ 06E$ 061E$ 063a$ 06%$ 06e$06%F$ 06aF$ 06ee$ 069#$ 06Fc$ 0693$ 06ac$ 0690$06%0$ 06a1$ 06G#$ 06E$ 063c$ 062$ 06G0$ 063$069c$ 061$ 06$ 062e$ 06aG$ 06cE$ 0629$ 06e$06%2$ 06$ 06#$ 06e#$ 06a$ 069a$ 06G$ 06G$0623$ 06ce$ 06$ 06F$ 06c$ 06c0$ 063E$ 06##$06EE$ 06#a$ 06$ 060$ 062$ 06Ea$ 069e$ 06c9$063#$ 0603$ 069$ 0609$ 062a$ 069%$ 069$ 06#$

06aE$ 060$ 0632$ 0622$ 06a$ 06c3$ 06E$ 06E3$

!age )0


36/44

061a$ 069E$ 0610$ 0691$ 060$ 0621$ 060G$ 06%#$06F9$ 060$ 06#$ 06G$ 06#0$ 06$ 06G2$ 06Fa$06G$ 063F$ 06E9$ 06GE$ 061#$ 06a$ 06%9$ 06c2$06c1$ 06e$ 06E$ 062$ 060$ 06a%$ 06Fe$ 060%$06a$ 063%$ 06G9$ 06e$ 06Ec$ 06%$ 06eG$ 06G%$060E$ 061G$ 061$ 061$ 06F$ 0611$ 06%$ 06c$06%$ 069F$ 06e1$ 06c$ 061$ 06E2$ 06F1$ 06F0$

06$ 06e2$ 0612$ 06#E$ 06cF$ 06%%$ 060#$ 0620$06e$ 06#c$ 06e0$ 06#$ 06F$ 06cc$ 06c$ 062%$069$ 06ec$ 062#$ 06$ 06E$ 06%E$ 0699$ 06GG$06G1$ 06a$ 06#9$ 06ca$ 0613$ 06a$ 06eF$ 06F$06eE$ 06Ge$ 06E0$ 06e3$ 063e$ 06%3$ 06E$ 06F2$06a2$ 063$ 06a0$ 06#F$ 06c#$ 06%$ 062$ 06E#$062c$ 062E$ 061$ 069$ 06GF$ 0600$ 06#G$ 063$063$ 061F$ 062$ 06$ 062F$ 06F$ 0692$ 06%G$06a3$ 06cG$ 06#e$ 06e%$ 06G$ 063$ 06#%$ 060a$069G$ 06G3$ 06F%$ 06e$ 06c%$ 06c$ 06FG$ 06#1

P

5hat do the first ; bytes containL

&i"tGt ha!h#ataU R

ha!h#ataU 0 R K ha!hpa#ta%leU &rl!tri"gU 0 R Rha!h#ataU 1 R K ha!hpa#ta%leU &rl!tri"gU 1 R Rha!h#ataU 2 R K ha!hpa#ta%leU &rl!tri"gU 2 R Rha!h#ataU 3 R K ha!hpa#ta%leU &rl!tri"gU 3 R R

or( !tri"gi"#e6 K 1 !tri"gi"#e6 < !tri"gle"ght !tri"gi"#e6VV )O

i( &rl!tri"gU !tri"gi"#e6 R KK 0 )O

%rea8Pi( ( &rl!tri"gU !tri"gi"#e6 R KK (&i"tGt) W'W )XX ( &rl!tri"gU !tri"gi"#e6 V 1 R KK 0 ) )O

%rea8Pha!h#ataU 0 R BK &rl!tri"gU 0 Rha!h#ataU 1 R BK &rl!tri"gU 1 Rha!h#ataU 2 R BK &rl!tri"gU 2 Rha!h#ataU 3 R BK &rl!tri"gU 3 R

ha!h#ataU 0 R K ha!hpa#ta%leU ha!h#ataU 0 R Rha!h#ataU 1 R K ha!hpa#ta%leU ha!h#ataU 1 R Rha!h#ataU 2 R K ha!hpa#ta%leU ha!h#ataU 2 R Rha!h#ataU 3 R K ha!hpa#ta%leU ha!h#ataU 3 R R

P

ha!hal&e K ha!h#ataU 3 Rha!hal&e


37/44

ha!hal&e


38/44

7ppendix 7. eferences$J%&'()*TitleD 2orensic -nalysis of Internet x!lorer -cti1ity 2iles-uthor3s4D eith J. Jones78/D htt!DRRsourceforge.netR!rojectsRodessaR

TitleD Microsoft 5indo"s Bro"ser +ache system info78/D htt!DRR""".con#net.comRY"#ranzRms"inbrz.txt

TitleD 8e1erse ngineering Index.dat78/D htt!DRR""".latenighthac#ing.comR!rojectsR9(()RreIndexatR

$+,-//0(*TitleD The I&.-T 2ile 2ormat-uthor3s4D Ceoff +ha!!ell78/D htt!DRR""".geoffcha!!ell.comRstudiesR"indo"sRieR"ininetRa!iRurlcacheRhash#ey.htmL

txO9(6=6)6;6

TitleD The ,ash -lgorithm for 78/ +aching-uthor3s4D Ceoff +ha!!ell78/D htt!DRR""".geoffcha!!ell.comRstudiesR"indo"sRieR"ininetRa!iRurlcacheRhash#ey.htmLtxO9(6=6)6;6

$B7&TI&C*TitleD 7nderstanding index.dat 2iles-uthor3s4D +a!tain 'te!hen M. Bunting78/D

htt!DRR"eb.archi1e.orgR"ebR9((:((?9(9)9?Rhtt!DRR09.0=?.9;.9?0RforensicsRindexdat0.htmhtt!DRR"eb.archi1e.orgR"ebR9((:((?9(():Rhtt!DRR09.0=?.9;.9?0RforensicsRindexdat9.htm

$M'&*TitleD Microsoft e1elo!er &et"or#78/D htt!DRRmsdn.microsoft.comR

7ppendix 9. :80 Free 5oc;mentation 2icenseAersion 0.)6 ) &o1ember 9((

Copyright Z 2000$ 2001$ 2002$ 200F$ 200G ,ree otare ,o&"#atio"$ 4"c.


39/44

This /icense is a #ind of Zco!yleftZ6 "hich means that deri1ati1e "or#s of the document mustthemsel1es be free in the same sense. It com!lements the C&7 Ceneral ublic /icense6 "hich is aco!yleft license designed for free soft"are.

5e ha1e designed this /icense in order to use it for manuals for free soft"are6 because free soft"are

needs free documentationD a free !rogram should come "ith manuals !ro1iding the same freedomsthat the soft"are does. But this /icense is not limited to soft"are manualsE it can be used for anytextual "or#6 regardless of subject matter or "hether it is !ublished as a !rinted boo#. 5erecommend this /icense !rinci!ally for "or#s "hose !ur!ose is instruction or reference.

,* A'ICA+I'I%- A.D DE"I.I%I/.SThis /icense a!!lies to any manual or other "or#6 in any medium6 that contains a notice !laced bythe co!yright holder saying it can be distributed under the terms of this /icense. 'uch a notice grantsa "orldF"ide6 royaltyFfree license6 unlimited in duration6 to use that "or# under the conditions statedherein. The ZocumentZ6 belo"6 refers to any such manual or "or#. -ny member of the !ublic is alicensee6 and is addressed as ZyouZ. Qou acce!t the license if you co!y6 modify or distribute the "or#

in a "ay reKuiring !ermission under co!yright la".

- ZModified AersionZ of the ocument means any "or# containing the ocument or a !ortion of it6either co!ied 1erbatim6 or "ith modifications andRor translated into another language.

- Z'econdary 'ectionZ is a named a!!endix or a frontFmatter section of the ocument that dealsexclusi1ely "ith the relationshi! of the !ublishers or authors of the ocument to the ocumentWso1erall subject 3or to related matters4 and contains nothing that could fall directly "ithin that o1erallsubject. 3Thus6 if the ocument is in !art a textboo# of mathematics6 a 'econdary 'ection may notex!lain any mathematics.4 The relationshi! could be a matter of historical connection "ith thesubject or "ith related matters6 or of legal6 commercial6 !hiloso!hical6 ethical or !olitical !osition

regarding them.

The ZIn1ariant 'ectionsZ are certain 'econdary 'ections "hose titles are designated6 as being thoseof In1ariant 'ections6 in the notice that says that the ocument is released under this /icense. If asection does not fit the abo1e definition of 'econdary then it is not allo"ed to be designated asIn1ariant. The ocument may contain zero In1ariant 'ections. If the ocument does not identify anyIn1ariant 'ections then there are none.

The Z+o1er TextsZ are certain short !assages of text that are listed6 as 2rontF+o1er Texts or Bac#F+o1er Texts6 in the notice that says that the ocument is released under this /icense. - 2rontF+o1erText may be at most ? "ords6 and a Bac#F+o1er Text may be at most 9? "ords.

- ZTrans!arentZ co!y of the ocument means a machineFreadable co!y6 re!resented in a format"hose s!ecification is a1ailable to the general !ublic6 that is suitable for re1ising the documentstraightfor"ardly "ith generic text editors or 3for images com!osed of !ixels4 generic !aint!rograms or 3for dra"ings4 some "idely a1ailable dra"ing editor6 and that is suitable for in!ut totext formatters or for automatic translation to a 1ariety of formats suitable for in!ut to textformatters. - co!y made in an other"ise Trans!arent file format "hose mar#u!6 or absence ofmar#u!6 has been arranged to th"art or discourage subseKuent modification by readers is notTrans!arent. -n image format is not Trans!arent if used for any substantial amount of text. - co!ythat is not ZTrans!arentZ is called Z%!aKueZ.

xam!les of suitable formats for Trans!arent co!ies include !lain -'+II "ithout mar#u!6 Texinfoin!ut format6 /aTe in!ut format6 'CM/ or M/ using a !ublicly a1ailable T6 and standardF

!age )?


40/44

conforming sim!le ,TM/6 ost'cri!t or 2 designed for human modification. xam!les oftrans!arent image formats include &C6 +2 and JC. %!aKue formats include !ro!rietary formatsthat can be read and edited only by !ro!rietary "ord !rocessors6 'CM/ or M/ for "hich the TandRor !rocessing tools are not generally a1ailable6 and the machineFgenerated ,TM/6 ost'cri!t or2 !roduced by some "ord !rocessors for out!ut !ur!oses only.

The ZTitle ageZ means6 for a !rinted boo#6 the title !age itself6 !lus such follo"ing !ages as areneeded to hold6 legibly6 the material this /icense reKuires to a!!ear in the title !age. 2or "or#s informats "hich do not ha1e any title !age as such6 ZTitle ageZ means the text near the most!rominent a!!earance of the "or#Ws title6 !receding the beginning of the body of the text.

The Z!ublisherZ means any !erson or entity that distributes co!ies of the ocument to the !ublic.

- section Zntitled QXZ means a named subunit of the ocument "hose title either is !reciselyQX or contains QX in !arentheses follo"ing text that translates QX in another language. 3,ereQX stands for a s!ecific section name mentioned belo"6 such as Z-c#no"ledgementsZ6ZedicationsZ6 ZndorsementsZ6 or Z,istoryZ.4 To Zreser1e the TitleZ of such a section "hen you

modify the ocument means that it remains a section Zntitled QXZ according to this definition.

The ocument may include 5arranty isclaimers next to the notice "hich states that this /icensea!!lies to the ocument. These 5arranty isclaimers are considered to be included by reference inthis /icense6 but only as regards disclaiming "arrantiesD any other im!lication that these 5arrantyisclaimers may ha1e is 1oid and has no effect on the meaning of this /icense.

0* VE#+A%IM C/-I.1Qou may co!y and distribute the ocument in any medium6 either commercially or noncommercially6!ro1ided that this /icense6 the co!yright notices6 and the license notice saying this /icense a!!lies tothe ocument are re!roduced in all co!ies6 and that you add no other conditions "hatsoe1er to

those of this /icense. Qou may not use technical measures to obstruct or control the reading orfurther co!ying of the co!ies you ma#e or distribute. ,o"e1er6 you may acce!t com!ensation inexchange for co!ies. If you distribute a large enough number of co!ies you must also follo" theconditions in section ).

Qou may also lend co!ies6 under the same conditions stated abo1e6 and you may !ublicly dis!layco!ies.

2* C/-I.1 I. 34A.%I%-If you !ublish !rinted co!ies 3or co!ies in media that commonly ha1e !rinted co1ers4 of theocument6 numbering more than 0((6 and the ocumentWs license notice reKuires +o1er Texts6 you

must enclose the co!ies in co1ers that carry6 clearly and legibly6 all these +o1er TextsD 2rontF+o1erTexts on the front co1er6 and Bac#F+o1er Texts on the bac# co1er. Both co1ers must also clearlyand legibly identify you as the !ublisher of these co!ies. The front co1er must !resent the full title"ith all "ords of the title eKually !rominent and 1isible. Qou may add other material on the co1ers inaddition. +o!ying "ith changes limited to the co1ers6 as long as they !reser1e the title of theocument and satisfy these conditions6 can be treated as 1erbatim co!ying in other res!ects.

If the reKuired texts for either co1er are too 1oluminous to fit legibly6 you should !ut the first oneslisted 3as many as fit reasonably4 on the actual co1er6 and continue the rest onto adjacent !ages.

If you !ublish or distribute %!aKue co!ies of the ocument numbering more than 0((6 you must

either include a machineFreadable Trans!arent co!y along "ith each %!aKue co!y6 or state in or "itheach %!aKue co!y a com!uterFnet"or# location from "hich the general net"or#Fusing !ublic has

!age )


41/44

access to do"nload using !ublicFstandard net"or# !rotocols a com!lete Trans!arent co!y of theocument6 free of added material. If you use the latter o!tion6 you must ta#e reasonably !rudentste!s6 "hen you begin distribution of %!aKue co!ies in Kuantity6 to ensure that this Trans!arent co!y"ill remain thus accessible at the stated location until at least one year after the last time youdistribute an %!aKue co!y 3directly or through your agents or retailers4 of that edition to the !ublic.

It is reKuested6 but not reKuired6 that you contact the authors of the ocument "ell beforeredistributing any large number of co!ies6 to gi1e them a chance to !ro1ide you "ith an u!dated1ersion of the ocument.

5* M/DI"ICA%I/.SQou may co!y and distribute a Modified Aersion of the ocument under the conditions of sections 9and ) abo1e6 !ro1ided that you release the Modified Aersion under !recisely this /icense6 "ith theModified Aersion filling the role of the ocument6 thus licensing distribution and modification of theModified Aersion to "hoe1er !ossesses a co!y of it. In addition6 you must do these things in theModified AersionD

-. 7se in the Title age 3and on the co1ers6 if any4 a title distinct from that of the ocument6

and from those of !re1ious 1ersions 3"hich should6 if there "ere any6 be listed in the ,istorysection of the ocument4. Qou may use the same title as a !re1ious 1ersion if the original!ublisher of that 1ersion gi1es !ermission.

B. /ist on the Title age6 as authors6 one or more !ersons or entities res!onsible forauthorshi! of the modifications in the Modified Aersion6 together "ith at least fi1e of the!rinci!al authors of the ocument 3all of its !rinci!al authors6 if it has fe"er than fi1e46 unlessthey release you from this reKuirement.

+. 'tate on the Title !age the name of the !ublisher of the Modified Aersion6 as the!ublisher.

. reser1e all the co!yright notices of the ocument. . -dd an a!!ro!riate co!yright notice for your modifications adjacent to the other co!yright

notices. 2. Include6 immediately after the co!yright notices6 a license notice gi1ing the !ublic

!ermission to use the Modified Aersion under the terms of this /icense6 in the form sho"n inthe -ddendum belo".

C. reser1e in that license notice the full lists of In1ariant 'ections and reKuired +o1er Textsgi1en in the ocumentWs license notice.

,. Include an unaltered co!y of this /icense. I. reser1e the section ntitled Z,istoryZ6 reser1e its Title6 and add to it an item stating at

least the title6 year6 ne" authors6 and !ublisher of the Modified Aersion as gi1en on the Titleage. If there is no section ntitled Z,istoryZ in the ocument6 create one stating the title6year6 authors6 and !ublisher of the ocument as gi1en on its Title age6 then add an item

describing the Modified Aersion as stated in the !re1ious sentence. J. reser1e the net"or# location6 if any6 gi1en in the ocument for !ublic access to a

Trans!arent co!y of the ocument6 and li#e"ise the net"or# locations gi1en in theocument for !re1ious 1ersions it "as based on. These may be !laced in the Z,istoryZsection. Qou may omit a net"or# location for a "or# that "as !ublished at least four yearsbefore the ocument itself6 or if the original !ublisher of the 1ersion it refers to gi1es!ermission.

. 2or any section ntitled Z-c#no"ledgementsZ or ZedicationsZ6 reser1e the Title of thesection6 and !reser1e in the section all the substance and tone of each of the contributorac#no"ledgements andRor dedications gi1en therein.

/. reser1e all the In1ariant 'ections of the ocument6 unaltered in their text and in their

titles. 'ection numbers or the eKui1alent are not considered !art of the section titles. M. elete any section ntitled ZndorsementsZ. 'uch a section may not be included in the

!age )=


42/44

Modified Aersion. &. o not retitle any existing section to be ntitled ZndorsementsZ or to conflict in title "ith

any In1ariant 'ection. %. reser1e any 5arranty isclaimers.

If the Modified Aersion includes ne" frontFmatter sections or a!!endices that Kualify as 'econdary

'ections and contain no material co!ied from the ocument6 you may at your o!tion designate someor all of these sections as in1ariant. To do this6 add their titles to the list of In1ariant 'ections in theModified AersionWs license notice. These titles must be distinct from any other section titles.

Qou may add a section ntitled ZndorsementsZ6 !ro1ided it contains nothing but endorsements ofyour Modified Aersion by 1arious !arties[for exam!le6 statements of !eer re1ie" or that the texthas been a!!ro1ed by an organization as the authoritati1e definition of a standard.

Qou may add a !assage of u! to fi1e "ords as a 2rontF+o1er Text6 and a !assage of u! to 9? "ordsas a Bac#F+o1er Text6 to the end of the list of +o1er Texts in the Modified Aersion. %nly one!assage of 2rontF+o1er Text and one of Bac#F+o1er Text may be added by 3or through

arrangements made by4 any one entity. If the ocument already includes a co1er text for the sameco1er6 !re1iously added by you or by arrangement made by the same entity you are acting on behalfof6 you may not add anotherE but you may re!lace the old one6 on ex!licit !ermission from the!re1ious !ublisher that added the old one.

The author3s4 and !ublisher3s4 of the ocument do not by this /icense gi1e !ermission to use theirnames for !ublicity for or to assert or im!ly endorsement of any Modified Aersion.

6* C/M+I.I.1 D/C4ME.%SQou may combine the ocument "ith other documents released under this /icense6 under the termsdefined in section ; abo1e for modified 1ersions6 !ro1ided that you include in the combination all of

the In1ariant 'ections of all of the original documents6 unmodified6 and list them all as In1ariant'ections of your combined "or# in its license notice6 and that you !reser1e all their 5arrantyisclaimers.

The combined "or# need only contain one co!y of this /icense6 and multi!le identical In1ariant'ections may be re!laced "ith a single co!y. If there are multi!le In1ariant 'ections "ith the samename but different contents6 ma#e the title of each such section uniKue by adding at the end of it6 in!arentheses6 the name of the original author or !ublisher of that section if #no"n6 or else a uniKuenumber. Ma#e the same adjustment to the section titles in the list of In1ariant 'ections in the licensenotice of the combined "or#.

In the combination6 you must combine any sections ntitled Z,istoryZ in the 1arious originaldocuments6 forming one section ntitled Z,istoryZE li#e"ise combine any sections ntitledZ-c#no"ledgementsZ6 and any sections ntitled ZedicationsZ. Qou must delete all sections ntitledZndorsementsZ.

7* C/''EC%I/.S /" D/C4ME.%SQou may ma#e a collection consisting of the ocument and other documents released under this/icense6 and re!lace the indi1idual co!ies of this /icense in the 1arious documents "ith a single co!ythat is included in the collection6 !ro1ided that you follo" the rules of this /icense for 1erbatimco!ying of each of the documents in all other res!ects.

Qou may extract a single document from such a collection6 and distribute it indi1idually under this/icense6 !ro1ided you insert a co!y of this /icense into the extracted document6 and follo" this

!age )


43/44

/icense in all other res!ects regarding 1erbatim co!ying of that document.

8* A11#E1A%I/. 9I% I.DEE.DE.% 9/#KS- com!ilation of the ocument or its deri1ati1es "ith other se!arate and inde!endent documents or"or#s6 in or on a 1olume of a storage or distribution medium6 is called an ZaggregateZ if theco!yright resulting from the com!ilation is not used to limit the legal rights of the com!ilationWs users

beyond "hat the indi1idual "or#s !ermit. 5hen the ocument is included in an aggregate6 this/icense does not a!!ly to the other "or#s in the aggregate "hich are not themsel1es deri1ati1e"or#s of the ocument.

If the +o1er Text reKuirement of section ) is a!!licable to these co!ies of the ocument6 then if theocument is less than one half of the entire aggregate6 the ocumentWs +o1er Texts may be !lacedon co1ers that brac#et the ocument "ithin the aggregate6 or the electronic eKui1alent of co1ers ifthe ocument is in electronic form. %ther"ise they must a!!ear on !rinted co1ers that brac#et the"hole aggregate.

;* %#A.S'A%I/.

Translation is considered a #ind of modification6 so you may distribute translations of the ocumentunder the terms of section ;. 8e!lacing In1ariant 'ections "ith translations reKuires s!ecial!ermission from their co!yright holders6 but you may include translations of some or all In1ariant'ections in addition to the original 1ersions of these In1ariant 'ections. Qou may include atranslation of this /icense6 and all the license notices in the ocument6 and any 5arrantyisclaimers6 !ro1ided that you also include the original nglish 1ersion of this /icense and theoriginal 1ersions of those notices and disclaimers. In case of a disagreement bet"een the translationand the original 1ersion of this /icense or a notice or disclaimer6 the original 1ersion "ill !re1ail.

If a section in the ocument is ntitled Z-c#no"ledgementsZ6 ZedicationsZ6 or Z,istoryZ6 thereKuirement 3section ;4 to reser1e its Title 3section 04 "ill ty!ically reKuire changing the actual title.


44/44

differ in detail to address ne" !roblems or concerns. 'ee htt!DRR""".gnu.orgRco!yleftR.

ach 1ersion of the /icense is gi1en a distinguishing 1ersion number. If the ocument s!ecifies thata !articular numbered 1ersion of this /icense Zor any later 1ersionZ a!!lies to it6 you ha1e the o!tionof follo"ing the terms and conditions either of that s!ecified 1ersion or of any later 1ersion that hasbeen !ublished 3not as a draft4 by the 2ree 'oft"are 2oundation. If the ocument does not s!ecify a

1ersion number of this /icense6 you may choose any 1ersion e1er !ublished 3not as a draft4 by the2ree 'oft"are 2oundation. If the ocument s!ecifies that a !roxy can decide "hich future 1ersionsof this /icense can be used6 that !roxyWs !ublic statement of acce!tance of a 1ersion !ermanentlyauthorizes you to choose that 1ersion for the ocument.

,,* #E'ICE.SI.1ZMassi1e Multiauthor +ollaboration 'iteZ 3or ZMM+ 'iteZ4 means any 5orld 5ide 5eb ser1er that!ublishes co!yrightable "or#s and also !ro1ides !rominent facilities for anybody to edit those"or#s. - !ublic "i#i that anybody can edit is an exam!le of such a ser1er. - ZMassi1e Multiauthor+ollaborationZ 3or ZMM+Z4 contained in the site means any set of co!yrightable "or#s thus!ublished on the MM+ site.

Z++FBQF'-Z means the +reati1e +ommons -ttributionF'hare -li#e ).( license !ublished by+reati1e +ommons +or!oration6 a notFforF!rofit cor!oration "ith a !rinci!al !lace of business in'an 2rancisco6 +alifornia6 as "ell as future co!yleft 1ersions of that license !ublished by that sameorganization.

ZIncor!orateZ means to !ublish or re!ublish a ocument6 in "hole or in !art6 as !art of anotherocument.

-n MM+ is Zeligible for relicensingZ if it is licensed under this /icense6 and if all "or#s that "erefirst !ublished under this /icense some"here other than this MM+6 and subseKuently incor!orated in

"hole or in !art into the MM+6 304 had no co1er texts or in1ariant sections6 and 394 "ere thusincor!orated !rior to &o1ember 06 9((.

The o!erator of an MM+ 'ite may re!ublish an MM+ contained in the site under ++FBQF'- on thesame site at any time before -ugust 06 9((:6 !ro1ided the MM+ is eligible for relicensing.

!age ;(

Documents

MSIE Cache File (index.dat) format.pdf