Accessing Deleted Web Activities: How to Recover Browsing History And Other Items

With Starus Web Detective you can access the user’s online activities by recovering cleared browsing histories and private browsing sessions. The built-in analysis engine accesses the hard drive directly, attempting to identify blocks of data related to the user’s Web browsing activities.

How to recover and analyse browsing history with:

Starus Web Detective™ 3.8

Scan hard drives, virtual machines and disk images for traces of the user’s online activities. Open Web browsing history, access search requests, analyse social network activities, view passwords and bookmarks and recover data from incognito sessions.

How to Launch Starus Web Detective

Download and install Starus Web Detective using the link above. The free trial version allows you to evaluate the program’s features, and has the following limitations:

  • Data export and extraction are not available
  • Only the first 10 browsing history records are shown

The tool will scan the system for Web browsing data located in all Windows accounts (C:\Users\[UserName]\AppData).

User's Choice

Administrative privileges are required to access data from other Windows accounts. You’ll be able to select a particular Windows account by using the menu located at the top right part of the user interface.

Browser selection

Once the initial scan is complete, you will gain access to multiple types of data.

Browsing History

You can start your analysis by checking out browsing history records located under the History tab. This tab contains information about the Web sites visited by the user along with timestamps and accompanying meta data (e.g. site name or page title). Click on the link to view how many times the Web page was visited, how much time the user spent on the page and whether or not the page was cleaned from the browser history.

● Visits
Contains all links visited from this computer with all supported Web browsers.


● Searches
Contains search requests submitted through many popular search engines.


● Social networks
Activities in social networks contain requests and submissions, comments and communications as well as other types of data (depending on the social network).

Social media

● Translations
Analyzes online translation sessions. Includes information about source and target languages, links and timestamps.

● Mail
Analyzes email activities. Contains information about messages sent and received on the computer. Click on each record to access additional information such as the subject and open date. The convenient filtering feature allows specifying filters to quickly locate Web sites by any part of the link or title. Click on the “plus” icon to access additional options:

  • Category
    Helps grouping Web sites by their type (e.g. News, Finances, Shopping, Gaming, Adult, Entertainment, Sports and other categories).
  • Transition type
    Contains information about referring resources. Allows identify Web page or resource (e.g. direct entry, Web search, frame, redirect etc.) that led the user to a particular Web page.
    Transition type
  • Number of visits
    Allows locating Web sites that are frequently visited by the user. You can specify exact or the minimum number of visits.
    Number of visits
  • Manually opened
    Users may open Web sites by manually typing their link in a browser. Specify the number of times (exact, approximate or minimum) the user manually opened Web sites.
    Manually opened
  • Duration
    Specify the range of time the user spent on the Web site. Minimum duration is 1 minute.
  • Last visit
    Time and date of the last time the user visited a Web site. Allows discovering Web sites last visited during a certain interval.
    Last visit
  • Removed from history
    This filter helps discover resources that were or were not manually removed from the browsing history.
    Removed from history

Sessions — aggregates browsing data to sessions. Contains information about the last session and the one before. This category helps analyse two last browsing sessions.


Frequently visited — this category helps identify Web sites frequently opened by the user. Frequently visited Web sites help analyse the user’s interests.

Popular sites

Bookmarks contain all existing and deleted (recovered) bookmarks.

Downloads contain files, images and documents downloaded by the user.

Some Web sites require the user to provide their name and address as well as any additional information. The Addresses tab helps analyse stored form data and personal information records.

Passwords contain authentication credentials, logins and passwords stored in the Web browser. These authentication credentials can be used to further analyse the user’s activities on other Web sites, social networks and online resources.


The Files tab presents the list of files that may be potentially useful for the investigation. The files can be previewed or recovered (saved) onto a different media. To recover a file, right-click on its record and click “Save”.

Images contain information about the pictures viewed or downloaded by the user. You will gain access to all images cached by the Web browser, including those that were deleted.

Images tab

Exporting Data
Starus Web Detective supports exporting information collected by the tool into Excel, HTML or PDF formats. The included Report Wizard allows specifying the range of dates and types of data to include in a report.

Data export
Export Wizard

Start exporting by launching the Export Wizard. You can export information that belongs to a certain user or to all local users on the computer. To finish exporting, specify file path and desired data format.

Export completions