EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition

Temporary Internet Files

In older versions of Microsoft Windows, the Temporary Internet Files folder, often called the “TIF folder” by many examiners, is located under the Local Settings folder. With Windows Vista (and beyond), since Internet cache does not follow a user in a domain, the TIF folder is a local setting and stored at C:\Users\%UserName%\AppData\Local\Microsoft\Windows\Temporary Internet Files\. Also recall that with Windows Vista (and beyond), Low folders will be present. Data from protected-mode Internet activity is in the Low folders, while activity from unprotected-mode Internet will be in the normal folders.

The folders contained in the TIF folder store the files downloaded and cached from the Internet. By storing or caching ...