Windows.edb Parser Comparison: SIDR, ESEDatabaseView & More
A fair comparison of Windows Search index parsers: SIDR, WinSearchDBAnalyzer, ESEDatabaseView, libesedb's esedbexport, sqlite3 and this browser-based parser.
Posts tagged: #windows-db
Windows Search Index Anti-Forensics and Its Limits
How the Windows Search index gets disabled, rebuilt, compacted or deleted, what each action leaves behind, and how to argue from a missing or empty index.
Windows Search Index Investigation: A Worked Example
A fictional intrusion on FIN-WKS-07 worked end to end from the Windows Search index: staging, a deleted credentials file, USB exfiltration and cloud upload.
Windows.db Forensics: SQLite, WAL and Gather Database
Windows 11 search index forensics: how Windows.db, Windows.db-wal and Windows-gather.db fit together, what the WAL reveals, and how not to destroy it.
Windows Search Index: Evidence of Deleted Files
How the Windows Search index keeps paths, metadata and text of deleted files, where each trace survives in Windows.edb and Windows.db, and how to verify it.
Windows Search Index Properties Explained for DFIR
System.ItemPathDisplay, System.Search.GatherTime, System.Search.AutoSummary and the other Windows Search properties that matter in an investigation.
How to Open Windows.edb and Windows.db (Step by Step)
Step-by-step: open and analyse a Windows Search index (Windows.edb or Windows.db) in your browser, read the flags, filter, and export a CSV for your timeline.
Windows.edb vs Windows.db: Windows 10 vs 11 Search Index
How the Windows Search index moved from the ESE Windows.edb of Windows 10 to the SQLite Windows.db of Windows 11: tables, layout, WAL and DFIR impact.
Where Is Windows.edb Stored? Location and Acquisition
Windows.edb and Windows.db location on Windows 10 and 11, which companion files to grab, and how to copy the locked Windows Search index from a live system.
Windows Search Index Forensics: The Complete Guide
What the Windows Search index records, where Windows.edb and Windows.db live, what survives file deletion, and how to analyse both formats in a DFIR case.