Windows.edb Parser Comparison: SIDR, ESEDatabaseView & More
A fair comparison of Windows Search index parsers: SIDR, WinSearchDBAnalyzer, ESEDatabaseView, libesedb's esedbexport, sqlite3 and this browser-based parser.
Blog
Articles, guides, and updates.
Windows Search Index Anti-Forensics and Its Limits
How the Windows Search index gets disabled, rebuilt, compacted or deleted, what each action leaves behind, and how to argue from a missing or empty index.
Windows Search Index Investigation: A Worked Example
A fictional intrusion on FIN-WKS-07 worked end to end from the Windows Search index: staging, a deleted credentials file, USB exfiltration and cloud upload.
Windows.edb Dirty Shutdown: Recover It with esentutl
Why a collected Windows.edb is in dirty-shutdown state, how to check it with esentutl /mh, and how to replay the MSS logs with esentutl /r safely on a copy.
Windows.db Forensics: SQLite, WAL and Gather Database
Windows 11 search index forensics: how Windows.db, Windows.db-wal and Windows-gather.db fit together, what the WAL reveals, and how not to destroy it.
ESE Database Forensics: Basics for Investigators
How an ESE (JET Blue) database like Windows.edb is built: header, pages, B+-trees, catalog, tagged columns, long values, compression and deleted records.
Windows Search Index: Evidence of Deleted Files
How the Windows Search index keeps paths, metadata and text of deleted files, where each trace survives in Windows.edb and Windows.db, and how to verify it.
Windows Search Index Properties Explained for DFIR
System.ItemPathDisplay, System.Search.GatherTime, System.Search.AutoSummary and the other Windows Search properties that matter in an investigation.
How to Open Windows.edb and Windows.db (Step by Step)
Step-by-step: open and analyse a Windows Search index (Windows.edb or Windows.db) in your browser, read the flags, filter, and export a CSV for your timeline.