Note: Below is an edited version of a reply I posted today to a thread on Deleting Internet History
I was curious about how "private" IE InPrivate Browsing really is, in relation to how savvy/resourceful a person or some software might be in following someone else's tracks.
So, I've been using InPrivate Browsing on various computers (with Windows XP) and using Notepad to open the index.dat file in C:/Documents and Settings/%Username%/Local Settings/Temporary Internet Files/Content.IE5 and comparing the contents before, during and after InPrivate sessions. During some of these "trials," I also had regular browsing windows open and toggled back and forth. The sequence of toggling was easily identifiable by large portions of text switching from "normal" to highly garbled and back again.
Yes, it's true that none of what I did showed up in the normally-accessible History, in the subfolders and index.dat files of History.IE5, or in the folder and subfolders of Temporary Internet Files. But it's become clear to me that many traces of websites, downloaded items and objects are pretty much "hiding in plain sight" in index.dat. Amdist the garble are clearly identifiable URLs and names of sites, properties of graphics and images (such as titles associated with pictures). In one trial--at least one in which I noticed--some of the identifiable data even showed that the user had gone into InPrivate Browsing in the first place and clearly showed the first URL visited before the garble started. In another trial, it appeared as if less and less identifiable data was hidden, the more new tabs and/or windows the user opened during a given InPrivate Browsing session.
So anyone knowledgeable enough to think about checking Content.IE5/index.dat--or at least anyone using a program that would look there--is likely to get a reasonably good idea of what was happening even during InPrivate Browsing sessions. That's something for parents to consider, I suppose.
Any comments, thoughts, reactions?