Automatically generated based on tag:
| Title | Type | Summary | Location |
|---|---|---|---|
| Registry - TypedURLs | Page | The TypedURLs registry key tracks URL entered (typed, pasted, or auto-completed) in the Internet Explorer (IE) web browser search bar. Web searches are not stored, only the URLs entered are tracked. Information of interest: URL entered in the IE search bar. Values are stored in inverse chronological order. The timestamp of last visit of the most recently visited URL can thus be deduced from the last write timestamp of the registry key. |
File: <SYSTEMDRIVE>:\Users\<USERNAME>\NTUSER.dat Registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedURLs |
| Web browsers | Page | The web browsers related artefacts can be split in the following categories: - User profile: web browsers, such as Chronium-based browsers (Chrome, Edge) and Firefox, implement a profile feature to store users settings, history, favorites, etc. The databases and files that store these information is usually stored under a user specific profile folder. - History: web browsing history and download history. - Cookies: web browsing cookies (session tokens). - Cache: cache of resources downloaded from accessed websites. - Sessions: tabs and windows from a browsing session. - Settings: configuration settings. |
Web browsers artefacts are often located under: - %LocalAppData%: <SYSTEMDRIVE>:\Users\<USERNAME>\AppData\Local. - %AppData%: <SYSTEMDRIVE>:\Users\<USERNAME>\AppData\Roaming. Internet Explorer ---------------------- Browsing history, downloads, cache, cookies metadata: %LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat. Cookies: %AppData%\Microsoft\Windows\Cookies. Sessions: %LocalAppData%\Microsoft\Internet Explorer\Recovery\*.dat. Edge (Legacy) ------------------- Browsing history, downloads, cache, cookies metadata: %LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat; User profiles: %LocalAppData%\Packages\Microsoft.MicrosoftEdge_XXX\AC. Cache: <USER_PROFILE>\MicrosoftEdge\Cache. Sessions: <USER_PROFILE>\MicrosoftEdge\User\Default\Recovery\Active. Settings: <USER_PROFILE>\User\Default\DataStore\Data ouser1\XXX\DBStore\spartan.edb. Edge (Chronium-based) -------------------------------- User profiles: %LocalAppData%\Microsoft\Edge\User Data\<Default | Profile X>. Browsing history: <USER_PROFILE>\History. Cookies: <USER_PROFILE>\Cookies. Cache: <USER_PROFILE>\Cache. Sessions: <USER_PROFILE>\Sessions. Settings: <USER_PROFILE>\Preferences. Google Chrome ---------------------- User profiles: %LocalAppData%\Google\Chrome\User Data\<Default | Profile X>. Browsing history: <USER_PROFILE>\History. Cookies: <USER_PROFILE>\Cookies. Cache: <USER_PROFILE>\Cache. Sessions: <USER_PROFILE>\Sessions. Settings: <USER_PROFILE>\Preferences. Mozilla Firefox -------------------- User profiles: %AppData%\Mozilla\Firefox\Profiles\<ID>.default-release. Browsing history, downloads, bookmarks: <USER_PROFILE>\places.sqlite. Cookies: <USER_PROFILE>\cookies.sqlite. Cache: <USER_PROFILE>\cache2\*. Sessions: <USER_PROFILE>\sessionstorebackups\*. Settings: <USER_PROFILE>\prefs.js. |
| WebCacheV01 | Page | The WebCacheV01.dat database is used by the Microsoft Internet Explorer and Microsoft Edge (legacy) web browsers to store browsing history, downloads, cache, and cookies. However, access to local files, not necessarily through a web browser, are also tracked in the WebCacheV01.dat database. Access to local files can be identified by the file URI scheme (such as "file:///<DRIVE_LETTER>:/folder/file"). Information of interest: full path to the file or URL, timestamp of access, and visit count. |
<SYSTEMDRIVE>:\Users\<USERNAME>\AppData\Local\Microsoft\Windows\WebCacheV01.dat |
| Windows 10 Timeline / ActivitiesCache.db | Page | Introduced in Windows 10 version 1803, the Windows Activity history tracks a number of operations on the system: programs used, local files opened, SharePoint documents consulted, and websites browsed (using Internet Explorer / Microsoft Edge Legacy). The ActivitiesCache.db database only stores data for the last 30 days by default. Information of interest, that depends on the activity type: start and end times of the activity (in UTC), executable full path for program execution, file name / SharePoint link for files accessed using certain programs, created and last modified timestamp of the associated file, etc. The history of the clipboard data may also be stored for a short amount of time (approximately 12 hours) in non default configuration. |
<SYSTEMROOT>\Users\<USERNAME>\AppData\Local\ConnectedDevicesPlatform\[L.<USERNAME> | *]\ActivitiesCache.db |
| Windows Search database | Page | The Windows Search database provides an index to the Windows Search feature to improve search speed by indexing content from a subset of folders and files. Information of interest: files and folders from the Users folders (file name, path, size, attributes, MAC timestamps, and sometimes part of the content of smaller files), Outlook mail data (timestamp of reception and possible mail content), OneNote notes title, and Internet Explorer history. |
Starting from Windows 11: <SYSTEMDRIVE>:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db <SYSTEMDRIVE>:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows-gather.db Windows 7 to Windows 10: <SYSTEMDRIVE>:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb Windows XP: <SYSTEMDRIVE>:\Documents and Settings\All user\Application Data\Microsoft\Search\Data\Application\Windows\Windows.edb |
View on GitHub