Internet Explorer 10 and above and programs that use the WinInet API on Windows may keep a list of cached resources inside the file WebCacheV01.dat, which persists across InPrivate sessions or even when if "delete browing history" is used, and is stored in plaintext.
https://www.sevenforums.com/browsers...ow-delete.html
http://www.ericlawrence.com/eric/sho...205:27:00%20PM
https://articles.forensicfocus.com/2...t-explorer-10/
I checked and confirmed this on my system. The file listed cached objects dating back to approximately two months ago, from both Internet Explorer and installers I ran, even though InPrivate is used at all times on the latter.
WebCacheV01.dat is locked by the CacheTask which runs as soon as a user logs in, so to delete (or open!) it without taking your system offline, you'll have to run something like this with administrative privileges.
Code:tskill iexplore schtasks /end /tn "\Microsoft\Windows\Wininet\CacheTask" cd /d "%localappdata%\Microsoft\Windows\WebCache" del /f /q *.* rem Or maybe sdelete -r *.* rem Or maybe for /f usebackq %a in (`dir /a /b`) do shred -fuzn 0 %a schtasks /run /tn "\Microsoft\Windows\Wininet\CacheTask"
Bookmarks