I had a very interesting experience when I tried to install Windows 7 on my desktop that has Windows XP 32bit installed on it. Well I knew that I could not simple upgrade a 32 bit OS to 64 bit OS. So it was going to be a dual boot on my machine. I downloaded Windows 7 64 bit DVD from MSDN. It was little naive of me to think that setup file on that DVD will actually run from 32 bit OS. Anyways, I gave it a try. That meant that I have to boot from my Windows 7 64 bit DVD. So I restarted the machine and chose of option of botting from CD/DVD. That did not go very well. The ISO download from MSDN was not bootable. And I could not find my DVD that Microsoft sent me as part of MSDN shipment. Well going by where there is will there is a way here is my work around to do Install Windows 7 64 bit on my Dell desktop.

So I came up with idea of first installing Windows Vista 64 bit on machine because I have boot CD for it. Well, that did not go very well. For some reason Dell desktops with SATA drives do not boot from MSDN disks. They always end up with BSOD. It has something to do with drivers for SATA drive that dell machines ship with. I knew Windows 7 boot disks work with dell machines. Luckily I had my Windows 7 N Edition (version that ships in Europe). So I went down the path of using that. And I got lucky with it. This DVD worked fine and I was able to install Windows 7 64 bit on my machine. One thing you want to do it not to choose the option of activating the serial number because I was about to upgrade this installation to regular Windows 7. Well now I came to know that you can not upgrade Winodws 7 N to Windows 7. Well that is ok because I did not need that installation anyways. Only thing I really needed was a 64 bit OS on my machine so I could launch set up files of regular Windows 7 64 bit. I inserted MSDN DVD for Windows 7 64 bit into the machine and went on with installation.

That was an interesting learning exercise for me.

Download Installation Files

Download Source Code

What is Dat File Viewer?

Simply put, this is a very light weight application that helps you see what all secrets microsoft is hiding in index.dat files in various folders under a user's profile. As per microsoft index.dat files are their cache or index files that they create to speed up access to various web sites, applications etc. But one thing lot of people have to come realize over the time that even after you clean up your Temporary Internet Files, Cookies, History etc. files from your windows machine, these index.dat files still carry all the footprints of your internet and file activities. So analysis of these files is used as one of the forensic tools when you want to recreate a user's internet activities in the past.

I am not going to go into details on format of index.dat files and other related technical details. Following link is an excellent technical resource on inside of index.dat file. This is by FoundStone.com a devision of McAfee.

• Index.dat White Paper

I have developed this open source application based on the original C code developed by FoundStone.com. This application is built using .Net framework.

Install It

• Download the insaller package associated with this post.
• Unzip this file in a folder.
• Double click on setup.exe to launch the installer.
• Follow the instructions and you are all set to go.

Pre-requisites

You will need to have Microsoft .Net Framework 4.0 installed on your machine to run this application. You can download the run time from the following location.

Download Microsoft .Net 4.0 Framework

I did not spend much time on the installer package to get automatic install of Microsoft .Net 4.0 framework. May be I will get to that in upcoming release. But for now, my apologies for making you do manual install of the framework if you do not already have it.

Run It

If you chose default installation option, you should have ByteBlocks Dat File Viewer entry in your start menu and you should be able to launch the applicaiton from there. If for some reason you do not see menu item in Start menu, then look under ProgramFiles/ByteBlocks folder the application. From there, you can double click on ByteBlocks.DatFileViewe.exe file to launch the application.

After you launch the application, you will see a splash screen with picture of a turtle in it. Depending on amount of data contained in your index.dat files, the application may require few seconds to load. So be little patient with load screen, the application will eventually load.

Export Results

The application allows you to export list of URLs or Coookies from following locations into a PDF file.

• Temporary Internet Files
• Cookies
• History

In the top menu of the application, click on Export > PDF link to generate PDF file.

Here is a code snippet that demonstrates how to get list of user accounts on your windows machine using .Net. Since there are no native .Net APIs to accomplish this task, you will need to use Interop to use Win32 APIs related to user management.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;

namespace UserEnvironment
{
 class Program
 {
  static void Main(string[] args)
  {
   Console.WriteLine(Environment.OSVersion.VersionString);
   Console.WriteLine("OS: {0}.{1}", 
    Environment.OSVersion.Version.Major, 
    Environment.OSVersion.Version.Minor);
   Console.WriteLine("****************************************");
   var accounts = GetListOfAccounts();
   if (accounts.Count != 0)
   {
    Console.WriteLine("User accounts on " + 
     System.Environment.MachineName + System.Environment.NewLine);
    foreach (var account in accounts)
    {
     Console.WriteLine(account);
    }
   }
   else
   {
    Console.WriteLine("No user account found!");
   }
  }

  static System.Collections.Specialized.StringCollection GetListOfAccounts()
  {
   int resumeHandle;
   int entriesRead;
   int totalEntries;
   IntPtr bufPtr;

   var userAccounts = new System.Collections.Specialized.StringCollection();
   NetUserWin32.NetUserEnum(null, 0, 2, out bufPtr, -1, 
    out entriesRead, out totalEntries, out resumeHandle);
   if (entriesRead > 0)
   {
    var users = new NetUserWin32.USER_INFO_0[entriesRead];
    IntPtr iter = bufPtr;
    for (int i = 0; i < entriesRead; i++)
    {
     users[i] = (NetUserWin32.USER_INFO_0)Marshal.PtrToStructure(iter, 
                           typeof(NetUserWin32.USER_INFO_0));
     iter = (IntPtr)((int)iter + Marshal.SizeOf(typeof(NetUserWin32.USER_INFO_0)));
     userAccounts.Add(users[i].Username);
    }
    NetUserWin32.NetApiBufferFree(bufPtr);
   }
   return userAccounts;
  }
 }
}

namespace UserEnvironment
{
 public class NetUserWin32
 {
  [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
  public struct USER_INFO_0
  {
   public String Username;
  }

  [DllImport("Netapi32.dll")]
  public extern static int NetUserEnum([MarshalAs(UnmanagedType.LPWStr)]string servername, 
    int level, int filter, out IntPtr bufptr, 
    int prefmaxlen, out int entriesread, out int totalentries,
    out int resume_handle);

  [DllImport("Netapi32.dll")]
  public extern static int NetApiBufferFree(IntPtr Buffer);
	}
}

What are version numbers for Windows operating system?

I keep getting this question so many times that I finally put it down here. This is not something that I came up with it. This information is available in Win32 SDK on MSDN.

In my previous post Fix STOP: 0x0000007B (OxF8968640, 0xC0000034, 0X00000000, 0x00000000), I described come remedies to that problem. The thing that started the whole thing was the following message.

I had Windows XP Home installed on my Dell Latitude E6500 laptop. I decided to upgrade it to Windows XP Professional. The upgrade completed without any problems. After laptop was rebooted, I had my nice login screen come up with all the user accounts listed. I clicked on my account and I got the above message. Since I have valid user license for Windows XP Professional, I clicked on "Yes" on the dialog box. Nothing happened. Usually a wizard starts that walks you through activation steps. I tried rebooting few times, booted in safe mode, repaired my installation. Nothing worked at all. I thought I could log into safe mode to do activation. Well, it told me that I can not activate copy of windows in safe mode. I tried to reboot with "Safe mode with Networking Support". That did not go very well because operating system refused to do so telling me that I have to activate copy of the windows before I could do so. After digging around and calling my preferential technical support at microsoft, I came to know the following things and fix for the problem.

• Windows Activation Wizard Depends on Installation of Internet Explorer. So much for not forcing users to have to install IE.
• Upgrade from Windows XP Home Basic to Windows XP Professional wiped my previous installation of IE8

So from above two issues you can see that I am in catch 22 situation and there was no way that activation wizard was going to come up. So here is the solution to the problem.

• Goto another machine that has CD/DVD burner
• Download full installer of Internet Explorer 8 (IE8)
• Burn IE8 on CD/DVD
• Now log in into "Safe Mode" on machine with activation problem
• Insert CD with IE8 installer
• Install IE8 on the machine
• Reboot the machine
• Now when This copy of Windows must be activated with Microsoft before you can log on. Do you want to activate Windows now? message dialog box pops up, click "Yes"
• This should bring up activation wizard and you should be able to complete your activation of copy of windows and use your machine normally.

Two days ago I decided to upgrade my Dell Latitude E6500 laptop from Windows XP Home Basic to Windows XP Professional. I decided not to do a clean install and use Upgrade option at install time. It upgraded fine. When I tried to log into the machine, i got the error message that I need to activate this version of Windows before I could use it. Well that is another story. I tried few things and decided to do a clean install. So I inserted my boot disk and made the laptop boot from it. All the drivers copied fine and when it went to step of Starting Windows Executive, BAM. I get the dreaded BSOD with error code STOP: 0x0000007B (OxF8968640, 0xC0000034, 0X00000000, 0x00000000). Well, this is a new laptop and was botting fine when I upgraded OS version. So it did not seem logical to think that hard disk is corrupted or some controller is failing. I remember that I had similar issue couple of years ago when I tried to upgrade OS on one of my Dell Precision Workstation. Then it hit me that at that time the problem was because of SATA drivers not being loaded from Windows XP install CD. And I had to ask Dell for installer CD that was used on that desktop. When you see this kind of error when you do any of the following:

• Reinstall OS from disk other than manufacturer
• Change your hard disk configuration
• You got SATA/RAID drives

First try to see if you can find your original OS disk that came with the machine or ask the manufacturer for a new one. There are different solutions proposed like disabling SATA option in BIOS. I do not feel comfortable with those options because it may introduce issues that may affect performance of your machine. I will strongly suggest using disk that has appropriate disk drivers.

I have been running Windows 7 for quite some time now. Lately I started seeing that every now and then machine will consume almost 100% CPU. Especially if machine resumes from hibernation it was taking few minutes to get it started completely and respond to mouse and keyboard events. So I started looking into Task Manager. I noticed that there was good amount of activity happening. And most of the activity was for operations that I did not care or I did not use or I did not know about. There were 2 processes that I am going to mention here.

Windows Media Player Network Sharing Service

I noticed that wmpncfg.exe process was consuming close to 35% of CPU. Then I looked in Service Control Manager and found this service. Interesting thing was that the service was configured to run Manually but it was already running. I never started it. This is what the description of this service says.

If you are not using media player to share your content, then you really do not need to run this service. Change the status of this service to Disabled.

Feed Sync

Second process that i noticed was msfeedssync.exe. This process was actually waking up at regular interval and consuming all the resources. The name pretty much tells that it has something to do with news feed synchronization. I had configured Windows Mail to read some feeds some time back. But then I had removed it from there. Windows Mail also adds these feeds to Internet Explorer as well. You can click on the feeds in Internet Explorer by clicking on Favorites button. The left pane has a tab for Feeds. You can see in the image below that there is one entry for news feed.

Now click on Tools > Internet Option menu option. It will bring up Internet options dialog box. Click on Content tab. At the bottom of the view you will notice section Feeds and web slices. Click on Settings button. It will bring up following dialog box. Notice that by default all feeds are set to be synchronized every 15 minutes. Turn this off if you are not using IE as news reader or you want to synchronize the feeds manually.

After I made these 2 changes, I saw significant improvement in performance of my laptop.

If you want to install Pwershell V2.0, one of the requirements is to uninstall previous versions of Powershell. If you don't do that, while installing V2.0, you will get message about uninstalling it. And the message does say to use Add/Remove Programs to uninstall it. So I went to Add/Remove Programs panel and could not find it there. That was frustrating. So I decicded to do some manual search about this installed program. All programs installed on Windows (if done right) have a registry entry at HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall location. If you search on that node for Powershell you will find a key for KB926139-2. Look at value for ParentDisplayName. It points to Windows XP - Software Updates. When we goto Add/Remove Programs control panel, the check box for Show Updates is usually not selected by default. So check that box and you should see all updates. Now you will find Powershell installation under Windows XP- Software Updates (depending on operating system you are using. You can now uninstall it from here. Following screen shot shows registry entry from my machine.

This morning i was searching my emails in Microsoft Outlook for an email with some attachment. Well bad luck ... i could not find the email and probably i deleted it. Here comes wonderful feature of temporary file storage to rescue. When you open an attachment in Outlook, application creates a temporary copy of this document on your machine. Each time you open the same attachment, a new copy of this attachment gets saved. These temporary files are located at following folder location.

C:\Documents and Settings\viper\Local Settings\Temporary Internet Files\Content.Outlook\8PVFOLU0

This path assumes that your OS is installed in C drive of your machine, which is the case for most users. Then you will look for user name under Document and Settings folder. For example in the path above, Viper is my user name. Only part of this path which is random is the last folder name. 8PVFOLU0 is randomly chosen when Outlook creates this folder. So in your case it could be different. So what you can do is, get down all the way to Content.Outlook folder and look for folders. One of those folders will have your files.

Your attachment files may not be there if:

• You have cleared temporary internet files folder
• You did not allocate sufficient space for temporary internet files and some of the content of outlook folder got trashed to make room for new content

Otherwise you are good to go and on the way to recovery.