I am currently trying to create a program that will extract information from an 'index.dat' file used by Internet Explorer to store internet history.
Currently the problem arises when attempting to find the file offsets for various HASH tables within the file (these tables are where the history entries are stored).
The hex values containing these offsets are at known locations within the file, so finding them is not a problem, however when attempting to extract these values my program seems to collapse. After much 'googling' and messing around I think I've identified where the problem lies.
When looking at the file in a hex editor I can see that the hex values of 0x01 and 0x00 are both given the symbol of '.', ultimately meaning my program treats the 0x01 values as 0x00 messing up any calculation I attempt to carry out.
Below is an extract of code to show my calculations to extract the values:
int hashOffset = hexToInt(raf, STARTING_OFFSET, NUMBER_BYTES); System.out.println("HASH Table Offset: 0x" + Integer.toString(hashOffset,16)); //size of HASH table int hashSize = hexToInt(raf, hashOffset + 4, NUMBER_BYTES) * RECORD_SIZE; System.out.println("HASH size: " + hashSize + " Bytes"); //next HASH table offset int nextHashOffset = hexToInt(raf, hashOffset + 8, NUMBER_BYTES); System.out.println("nextHashOff: 0x" + Integer.toString(nextHashOffset,16)); System.out.println("");private int hexToInt(RandomAccessFile raf, int startLocation, int numberOfBytes) throws Exception { byte[] buf = hexRead(raf, startLocation, numberOfBytes); int total=0; for(int i = 0; i < numberOfBytes; i++) { total += buf[i] << 8*i; } return total; }//end hexToIntprivate byte[] hexRead (RandomAccessFile raf, int offset, int numberOfBytes) throws Exception { byte[] buf = new byte[numberOfBytes]; raf.seek(offset); raf.read(buf,0,numberOfBytes); return buf; }//end hexRead
I dont't believe the problem lies in my calculations as they work perfectly for previous values. None of these values however contain 0x01. Possibly lies in the way the file is read?
If anyone could offer any advice as how to get round this, it would be greatly appreciated.
Thanks in advance,
David.