locked
Determining when cookies were cleared RRS feed

  • Question

  • I have an unusual question posed to me by a customer. The customer has two employees in her office - one of them cleared cache and cookies in IE (something she relies on heavily). Both employees state it was not them; she wants to find out who is being dishonest. She is looking to determine the exact date/time this was done. I am looking at Event Logs, but don't believe they record that action. Just curious if any of you have ever encountered this, or have found a way (either through logs or programmatically) to determine when the cache/cookies were cleared.
    Tuesday, June 7, 2016 1:20 AM

Answers

  • Hi JeremiahLogan,

    Based on my knowledge and search, there is no build-in feature could implement this function. The cookie is located in user profile. If we don’t audit before delete the cookie, it’s difficult to check. If the file is important for you, maybe we need to use other tools or ask Data Recovery Center.

    Hope it will be helpful to you.


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    • Marked as answer by JeremiahLogan Thursday, June 9, 2016 12:20 PM
    Wednesday, June 8, 2016 9:57 AM

All replies

  • Hi JeremiahLogan,

    Based on my knowledge and search, there is no build-in feature could implement this function. The cookie is located in user profile. If we don’t audit before delete the cookie, it’s difficult to check. If the file is important for you, maybe we need to use other tools or ask Data Recovery Center.

    Hope it will be helpful to you.


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    • Marked as answer by JeremiahLogan Thursday, June 9, 2016 12:20 PM
    Wednesday, June 8, 2016 9:57 AM
  • Thanks Carl Fan. I thought as much but wanted to check before I respond to the customer. She is not worried about recovering anything so much as she is wanting to know who did it and when. I have since taken steps to educate her on better security practices, so we can prevent this from happening again. She may just have to chalk this one up to a lesson learned.
    Wednesday, June 8, 2016 1:59 PM
  • Hi JeremiiahLogan,

    Thank you for your reply. Smart as you, it's important for security practices. If any further help needed, please feel free to post back.

    Best regards,

    Carl Fan


    Please mark the reply as an answer if you find it is helpful.

    If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, June 10, 2016 3:04 AM
  • looking to determine the exact date/time this was done.

    Depending on how it was done you may get some clues from creation dates.  Date modified and Date accessed of course would be inconclusive but I imagine (don't know, haven't tested) Creation date could be relevant, especially for hidden directories.

    HTH



    Robert Aldwinckle
    ---

    Friday, June 10, 2016 2:51 PM
    Answerer