Have you ever clicked the link to a Craigslist ad of something you were previously looking at, only to find it was deleted, flagged, or an error message? Well, by taking advantage of “offline mode”, you can see its original contents, pictures and all!
Update: Law enforcement, SIU, government, private investigators, and industry regulators can use Harmari Search for Craigslist to find old, deleted or expired Craigslist ads.
So here’s where you start: go to the link that is giving the error:
It’s not the end of the world; you can still retrieve the old ad by clicking Work Offline in your Internet Explorer browser.
So now you should see the title bar with “Offline Mode”. Now click the Refresh button to refresh the page.
Now you should see the original ad if all is in place
Why this works:
When you visit a website for the first time, the browser stores all the pictures, the webpage code and everything related to rendering the page in its cache. By going into Offline Mode, you are effectively cutting off your Internet connection and loading the website from your computer’s memory, stored in the cache.
Browsing the cache from your address bar
If you don’t have the link to the Craigslist ad, then there’s still a chance to look through the cache on your Internet Explorer browser to retrieve the ad. Just go into the address bar, erase everything else, and type in “craig”. Do not press Enter, and do not click anything. Just type those letters in. You’ll get a set of “close matches” based on Internet Explorer guessing what you’re trying to type.
If you don’t recognize the title of the ad in the results shown, you can expand the number of matches by clicking on the arrow indicated below:
If you still do not recognize it, try to add a few special letters that correspond to the category in which you were shopping. For example, “Autos for sale – by owner” is represented by “cto”. See below for how the results change with those letters added in.
Old EBay Auction Pages
The same techniques above can also apply for other websites like eBay:
You can also search by keywords within the address bar, as long as you don’t press enter and don’t click on anything!
Forensic Search of Temporary Internet Files
If these efforts did not prove helpful, then you can try browsing the cache directly by following these 3 steps, indicated below:
You should now get a new window to appear, similar to the one below. Now keyword search for files that contain “.htm” and you will narrow down the results to the websites themselves.
Clicking on any of those html files should display the old Craigslist page as it used to appear. All this is valid only when you are in Offline Mode. If you try going to another website, then your browser will ask you whether you want to go Online or stay offline.
Only go online if your investigation is completed. If you browse these files while in Online mode, you risk compromising your own investigation. The new website might overwrite the old files in cache, and valuable evidence may be deleted. Consult with a Computer Forensics expert if you are unsure what you are doing.
Professional Computer Forensics Tools
If you still can’t find the old ads, or auction page, then perhaps it was deleted. The browser’s cache can easily be deleted to cleanup space or cover the tracks. In these instances, it is better to use a professional computer forensics tool such as BelkaSoft or Jadsoft.
Other browsers / operating systems
The screenshots in this post were generated with the Internet Explorer 8 browser and Windows 7 operating system. The steps will likely be different in other browsers and operating systems, but inevitably every browser worth its salt has an Offline Mode.