Browser optimize

Track a user's Internet Explorer History with IEHistoryView

Wally Bahny shows you how to use IEHistoryView to quickly and systematically see a user's browsing history.

Tracking a user's browsing history can be both an expensive and a daunting task, especially if you're a one-man shop in a small company. For those that are blessed with users that behave while they're online at work, you are lucky indeed. For the rest of us, there is IEHistoryView.

Created by Nir Sofer, owner and operator of NirSoft, IEHV is a simple, yet powerful, tool with a fairly small footprint (37 KB). Downloading and installing IEHV is as simple as getting the zip file from the Web site and extracting the three included files into the folder of your choice.

Included are the executable (with both GUI and command-line functionality), a compiled HTML (.CHM) help file, and a ReadMe file that contains version history and some quick-start instructions.

This blog post is also available in the PDF format in a TechRepublic Download, which includes all the code in a separate file for easy copying.

Initial look

The first thing you see when opening IEHV is a grid interface of the current user's Internet Explorer history (Figure A). As we look around, there are several toolbar buttons and a few standard menus as well.

Figure A

Current user's Internet Explorer history
As in most well-designed Windows programs, all the toolbar functions can be found in one of the standard menus. In these menus (Figure B) we see several familiar options as well as many more that we will either have to guess at or try out. (I edited the opened four menus together in the same image. The actual application does not function in this manner.)

Figure B

All the menu screens at the same time
Delving right in, scroll through the grid to get a nice reverse-order history of the user's browser activity (Figure C, which is edited together from several screen shots).

Figure C

Scrolling through the history

Looking at this user, after they went through the Microsoft RunOnce wizard they first fired up XKCD.com (important things first) then went to TechRepublic and read several articles and blogs as well as viewed a photo gallery or two. After leaving TechRepublic, the user Googles the Google Headquarters and then checks out the headlines on MSN.com. Finally, this person Googles "crack WEP encryption" (must have gotten the idea from "Video: How to Spoof a MAC Address" viewed earlier) and then spent some time browsing a few sites on the topic before logging off.

Viewing other users, other folders, and subfolders

So, now we know what the logged-in user has done on the Internet. But, what if you wanted to look at another user's history on the same machine, a different machine, or just wanted to look at a particular date or range of dates? IEHV has the ability to browse the list of user accounts on the local machine as well as give the user the ability to specify a history folder (useful for networked computers) or a history subfolder (to look at a shorter period of time), which can be seen in Figure D.

Figure D

Viewing different folders
Choosing either another user from the user accounts chooser or specifying a history folder will give the same type of information as we saw in the initial view. The main difference is in the history subfolder. As you can see in Figure E, the Hit counts are much smaller than in the main view. I was unable to find anything in the documentation to explain this, so I simply chalked it up to a functionality of Internet Explorer (perhaps the main view shows image hits as their own hit under the page they are loaded from).

Figure E

History subfolder of another user

Saving, deleting, exporting, and printing

By checking the boxes next to one or more of the entries in the grid, several of the menu options become usable.

  • Save: export a formatted list of checked history records to a plain text, HTML, or XML file for further review
  • Delete: delete checked items from the IE history index file
  • Copy: copy checked items to the clipboard so they can be pasted into another application such as Microsoft Excel
  • HTML Report: create a table-based HTML report for further review
  • Create Links: create Favorites in Internet Explorer for easy review of a site's content. Also useful if you forgot to bookmark a site you really liked.

Other functionality

So, what else can we do with it? Well, there are a couple of different Search functions. The first, "Find History Item," is your traditional search dialog. Also available is "Select by URL," which allows the user to input several carriage-return-delimited strings that are searched for and automatically selected in the grid.

One feature in the menus that stood out was "Show All Google Searches" (Figure F). This does exactly what it says: it shows all Google searches that haven't been cleared from the browser.

Figure F

Showing all Google Searches
After pretty much exhausting the menus, the next thing to try is right-clicking on one of the records. Some of the same functionality that is in the menus and toolbars is also available via a right-click context menu (Figure G).

Figure G

Right-click context menu
Let's look into the properties screen (Figure H). The properties screen shows the same information that is in the grid, just laid out in a traditional data form format.

Figure H

Properties screen

Command-line functionality

The command-line functionality is a little more difficult to jump right into, and a simple "iehv /?" just launched the GUI.

Here is the command-line syntax:

iehv [/Action] ["Destination File"] {-Source Type} {"Source"}
  • Action: tells IEHV what type of file you would like to export to. Options are similar to the GUI Save function.
  • Destination File: absolute or relative path and file name to store the exported data
  • Source Type and Source: optional parameters used to redirect IEHV away from the currently logged-on user (similar to the functions above in Figure D)
Figure I shows the failed attempts at discovering command-line options as well as a simple implementation of the command line that exports all History for User "TRTest" to a tab-delimited text file named "export.tab." While not as easy to use for simply viewing, the command line would be very useful for reporting and archiving.

Figure I

Command line

Aggregating and archiving

The following section is simply a "proof of concept" that should not be taken as a complete solution. I have used VB.NET 2005 to demonstrate these ideas.

The core to this concept is executing the command line, writing the data to a temporary file, and then reading that data into a VB.NET application for aggregation and archival. The challenge is to build the command line for each computer/user/folder you want to aggregate.

Executing a command line from Visual Basic is limited to a few options. I could use the Shell() command, but the outputs of that are very limited and Shell can be temperamental. The .NET Framework also has a Process class within the System.Diagnostics namespace that seems a bit more robust, so we'll use that.

NOTE: Please refer to the documentation on System.Diagnostics.Process for more detail.

Among other things, the Process class has options for a File Name as well as Arguments. The File Name is the full path to the IEHV executable and the Arguments will be filled in dynamically with the custom-built string we'll create later. The command line we will use is:

iehv /stab "%temp%iehv.tab" -folder "pathtoIEHistoryFolder"

What this command does is create an output of a specified History folder to a temporary tab-delimited text file in the user's temp folder. So, we first break off the "iehv" because that is being handled in the Process class' File Name property. Next, we need to use the .NET Framework to get the user's temp folder path and substitute that in for "%temp%". Finally we need to ask the user to specify the path to import into our application.

Prompting the user for this information can be done in one of many ways, depending on how sophisticated you want the application to be and how many folders you want to import in a batch. For the purposes of this proof, we will assume that you want to gather usage for all users on one specified machine and load that information into a DataTable, which can be tied to a backend database.

Code Listing A shows a snippet of how to get the user's temp folder as well as loop through the user directories gathering the Internet Explorer History and loading it into the DataTable.

Listing A

Dim strTempDir As String = _

Environment.GetEnvironmentVariable("temp", _ EnvironmentVariableTarget.User)

For Each strProfileDir As String In _

IO.Directory.GetDirectories("\" & Me.txtComputerName.Text & _

"c$documents and settings")

Dim strProfileDirParts As String() = strProfileDir.Split("\"c)

Dim strProfileName As String = _

strProfileDirParts(strProfileDirParts.Length - 1)

Me.psIEHV.StartInfo.Arguments = "/stab """ & strTempDir & _

"iehv.txt"" -folder ""\" & _

Me.txtComputerName.Text & _

"c$Documents and Settings\" & _

strProfileName & "Local SettingsHistory\"""

Me.psIEHV.Start()

Do While Me.psIEHV.HasExited = False

Loop

If Me.psIEHV.HasExited = True Then

Dim fs As New FileStream(strTempDir & "iehv.txt", _

FileMode.Open, FileAccess.Read)

Dim sr As New StreamReader(fs)

Dim strImport As String = sr.ReadToEnd()

For Each strEntry As String In _

strImport.Split(New String() {ControlChars.CrLf}, _

StringSplitOptions.RemoveEmptyEntries)

strEntry = strEntry.Substring(0, strEntry.Length - 1)

Dim strEntryParts As New List(Of String)

strEntryParts.Add(strComputer)

strEntryParts.AddRange(strEntry. _

Split(ControlChars.Tab))

Me.DsHistory.dtHistory.Rows.Add(strEntryParts. _

ToArray())

Next

sr.Close()

fs.Close()

sr = Nothing

fs = Nothing

End If

Next

Considerations

IEHistoryView can allow an administrator to quickly see a user's browsing history without extensive configuration and preparation. For more advanced archival needs, the command line can be used alongside some custom programming to create a simple, low-cost (time is money) Internet usage monitor.

Using IEHV to monitor Internet usage is dependent on users not deleting their browsing history through Internet Explorer. Fortunately, those rights can be controlled via Group Policy as discussed in this IT Dojo blog post.

14 comments
alphatwin
alphatwin

Here is a super quick way to see a users History remotely without any prompting what so ever anywhere on your network: [code] color a cls @echo off echo. echo. echo Welcome to IEHV (Internet Explorer History Viewer) echo. echo. Set /p Computer=Enter the computer you wish to check the IE History on?: echo. echo. echo. dir "\\%computer%\c$\documents and settings" /ad echo. echo. echo. echo Pick the user profile that correctly applies from the echo above list so that it can be maped to your Z drive. echo. Set /p user=...........................: net use /del z: net use z: "\\%computer%\c$\documents and settings\%user%\Local Settings\History" iehv.exe net use /del z: exit [end code] (copy the above code into a .bat file) All you have to do at this point is change it to look at your Z drive and set it to be permanent.

Beoweolf
Beoweolf

This program and its use is smarmy at best, prurient and needlessly invasive at worse. At heart, I am an advocate for privacy, unless and until there is a demonstrated pattern of anti-social, homicidal, deceptive or medically diagnosed deviant behavior. Sure, I would like to know all the 'dirt' on my neighbors - but just as surely, I want to keep my little eccentricities private. From the enthusiastic reception of this enhance, surreptitious software, I appear to be a decided minority - in IT as well as politically. However, I did choose to download the program ... ???er, ah - for research purposes only.

pablo1319
pablo1319

Good tool for spying on others.

cmate
cmate

Excellent utility and very ease to use. Might even surprise the user as to what sites they "accidentally" check-out themself. Great suggestion. Just load on to a Flash drive and take around with you ... no installation, just run the .exe file and all is exposed. Save their skins if you like by deleting their history.

Wally Bahny
Wally Bahny

I don't know, I haven't worked with IE8 yet. If I had to guess, I would say it wouldn't show up, as that's the point of the InPrivate browsing.

bexsta95
bexsta95

How did you download this program? Your help would be wonderful!

lensdoc
lensdoc

That is both truthful and correct. May there be more of your kind in this world.

Wally Bahny
Wally Bahny

I agree with you most of the time. When you've got an user that is being complained about, it's nice to have evidence for HR to toast them for not doing their job. --- Forgot to monitor this post for replies -- oops...

seanferd
seanferd

Lots of nifty little tools.

lensdoc
lensdoc

Cmate you know how to use a tool for the good of others and I consider that something to commend. If we save others, we will be saved ourselves, for god knows how many stupid sites I have been invited into in a round about manner and been confused. None of us sits furtively at the computer doing underhand stuff, but when life is part of the net, then one is bound to visit a site or two which will be condemning in the hands of bad people. Thank you for indicating the right use of a good software. Nicolas

clarkcomputer
clarkcomputer

Great idea!! Another tool I can add to the flash drive I carry around on support calls. This will help small offices manage their 1-3 computers and users. Business owners sometimes ask me about how to check things like that.

cwise
cwise

Is there some way to program and standard flash drive to become a "bootable" flash drive. I have a cd but sometimes it is hard to remember to carry it with me. My flash drives I keep on a larit around my neck and caryy them all time time.