I want to catch someone slippin at work. I know he looks at boobie videos and other crap to get his computer all juiced up with trojans and spyware but I cant prove it because he deletes his history.
Is there anyway I can go into windows to find his browser history if he deletes it off IE?

Check temp internet files for cookies and images from suspect websites.

Even if he deletes his history, chances are he doesn't delete his index.dat file. I would try looking there first.

Another option I have used in the past is to apply a GPO that disables history from being deleted. There is still a way to bypass the GPO, but it takes a bit of skill. I think the GPO only works with IE, and I'm not sure if there is a pack out there for other browsers. But you can block the executables of the other browsers.

What is a GPO and how do I set it up on his computer? We are using IE8 or whatever number the current IE browser is.

Where is the index.dat file? Do I need a special program to open it?

I found an index.dat file in windows\temp\history is this it? I cant open it

The index.dat that I use is in a hidden folder. c:\documents settings\username\cookies\index.dat

The index file is written in binary so you will need a special program to read them. I use one called Super Winspy. You will be surprised as to all the info you can find when tracking the various index.dat files on a profile.

I forgot to mention that you will need to type in the path. The file is usually hidden even with the "show hidden files" option selected.

If your company uses a proxy server the history will be on the proxy showing the source and detination IP's.