3

I would like to check a machine's Internet browsing history and I would like to do this from the the command line or PowerShell.

Are there any Windows commands or tools for doing this?

3 Answers 3

4

You can view cached DNS entries from CMD.

Every time you browse to a web page, your PC has to request the IP Address for that web site from your default DNS server, and then caches them locally on your machine for a while to speed up future access to that web site — even in a private browsing session.

You can see these for yourself by opening up a command prompt and typing in ipconfig /displaydns to see the full list of cached DNS entries.

Now, the first thing you’ll notice is that a whole lot of information will appear, to the point that all of it can’t fit in the command prompt. What you can do is take the output of the command and send it to a text file somewhere on your machine.

ipconfig /displaydns > c:\desired location

Now, when you open that file you’ll see information about the websites you've visited directly or indirectly.

To get rid of this, just type the command ipconfig /flushdns and your DNS cache will be cleared.

Angel Luis has written a nice tutorial and script on this topic, I suggest you read it.

1
  • 1
    DNS records returned by ipconfig /displaydns are subject to expiration after a time, and other events (such as a reboot) will clear the cache as well. This method's ability to access browsing history is limited accordingly. Aug 9, 2017 at 22:29
1

Perhaps check out Nirsoft's IEHistoryView, as it allows saving the resutls to a text file:

This utility reads all information from the history file on your computer, and displays the list of all URLs that you have visited in the last few days. It also allows you to select one or more URL addresses, and then remove them from the history file or save them into text, HTML or XML file. In addition, you are allowed to view the visited URL list of other user profiles on your computer, and even access the visited URL list on a remote computer, as long as you have permission to access the history folder.

1
  • There's MozillaHistoryView as well.
    – Karan
    Jan 14, 2013 at 3:55
0

In PowerShell, this will display just the DNS names:

ipconfig /displaydns|?{$_ -like "Record Name"}

And this will display the IP and Record Type:

ipconfig /displaydns|?{$_ -like "Record"}

Type 1 is an A record and type 5 is an alias.

Not the answer you're looking for? Browse other questions tagged or ask your own question.