Windows Search Index Investigation: A Worked Example
A fictional intrusion on FIN-WKS-07 worked end to end from the Windows Search index: staging, a deleted credentials file, USB exfiltration and cloud upload.
Posts tagged: #dfir
Windows.db Forensics: SQLite, WAL and Gather Database
Windows 11 search index forensics: how Windows.db, Windows.db-wal and Windows-gather.db fit together, what the WAL reveals, and how not to destroy it.
ESE Database Forensics: Basics for Investigators
How an ESE (JET Blue) database like Windows.edb is built: header, pages, B+-trees, catalog, tagged columns, long values, compression and deleted records.
Windows Search Index Properties Explained for DFIR
System.ItemPathDisplay, System.Search.GatherTime, System.Search.AutoSummary and the other Windows Search properties that matter in an investigation.
Windows Search Index Forensics: The Complete Guide
What the Windows Search index records, where Windows.edb and Windows.db live, what survives file deletion, and how to analyse both formats in a DFIR case.