How Microsoft spies on us

There are some hidden files in which Windows keeps information about what we’ve done on our PC’s. For example: Windows does not really clean your IE history even after you instructed it to do so, and it does not erase your mail even if you deleted it from Outlook.

How it’s done

The information is usually stored in “index.dat” files, which are contained in folders named “name.ie5″ (ex: Content.ie5, history.ie5, etc). They appear hidden because of some instructions kept in the “desktop.ini” files contained in the name.ie5 folder and the parent folder. This way, they cannot appear in Windows Explorer (even with the “show hidden files” attribute enabled), in searches, nor in MS-DOS after a proper directory listing. An example:

1. Open a Command Prompt window (start->run->cmd)
2. Change directory to WP:\Documents and Settings\User\locals~1\tempor~1 (where WP=your Windows Partition and User=your username)
3. List the contents of the directory by typing “dir”. As you can see, no directory in the “name.ie5″ form appears in the listing.
4. Type “desktop.ini” to open this file. As you can see it contains some text:
   [.ShellClassInfo]
   UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
5. Now change directory to “Content.ie5″ (you can see it accesses it even if it doesn’t appear in the directory listing).
6. Again, open the “desktop.ini” files which belongs to this directory. As you can see, it again contains the information:
   [.ShellClassInfo]
   UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}

Desktop.ini files contain information that customizes certain aspects of the directory it belongs to; in this case, the UICLSID attribute with the given value cloaks the folder in Windows Explorer. In other files, desktop.ini may contain another attribute, CLSID, which makes the “Search” utility not to look in these folders. To see for yourself, simply delete the “desktop.ini” files and you will see that after that the directory will normally appear in Windows Explorer and in searches.
But, deleting them isn’t enough because Windows reconstructs them at every boot. So,delete everything in the file except the [.ShellClassInfo] line; this will fool Windows into thinking they’ve still covered their tracks.