Windows Search Index Properties Explained for DFIR
System.ItemPathDisplay, System.Search.GatherTime, System.Search.AutoSummary and the other Windows Search properties that matter in an investigation.
TL;DR. Every item in the Windows Search index is a bag of Windows shell properties keyed by a WorkId. A dozen of them carry most of the forensic value: System.ItemPathDisplay (full path), System.Size, System.FileOwner, System.DateCreated / DateModified / DateAccessed (file system times as seen at indexing), System.Search.GatherTime (when the indexer processed the item), System.Search.AutoSummary (a content extract), System.ItemType and System.Kind (what it is), and URL properties for web history. Microsoft documents what each property means, not how the database stores it. All times are FILETIMEs in UTC.
Where the properties come from
The Windows property system defines canonical names such as System.ItemPathDisplay, each with a format ID and property ID (a PROPERTYKEY). The indexer runs property handlers over each file and stores the values. In Windows.edb each property is a column named like 4447-System_ItemPathDisplay. In Windows.db it is a row whose ColumnId maps to the name through SystemIndex_1_PropertyStore_Metadata. The format comparison shows both layouts.
The numeric prefix is local to the database. Go by the name. Microsoft's reference pages give the meaning and type of every name, for example System.ItemPathDisplay.
The properties that matter
Identity and location
| Property | Meaning (Microsoft) | Forensic notes |
|---|---|---|
System.ItemPathDisplay | User-friendly display path of the item | The path you quote. Includes the extension. Localised if a localised name exists. UNC paths for shares. |
System.ItemUrl | URL form, with scheme (file:, iehistory:, mapi:…) | Tells you what kind of item it is: file, web history, mail. |
System.ItemFolderPathDisplay | Folder part of the path | Handy for grouping staging folders. |
System.FileName / System.ItemNameDisplay | File name / display name | Display name may hide the extension. |
System.ComputerName | Name of the computer where the item is located | Useful when indexes from several hosts are mixed in one case. |
Microsoft's own examples for System.ItemPathDisplay include a local path, a UNC path and a mailbox path, which tells you the index covers more than local files.
Type
| Property | Meaning | Forensic notes |
|---|---|---|
System.ItemType | Canonical type, usually the extension (.exe, .zip) or Directory | Special values exist, such as ActivityHistoryItem for activity records. |
System.ItemTypeText | Human-readable type ("Application", "Text Document") | Localised. Do not filter on it. |
System.Kind | Category mapped from the extension: document, program, folder, link, webhistory… | Microsoft maps extensions to kinds in the KindMap registry key. Multi-valued. |
System.FileAttributes | Win32 file attributes | Hidden / system attributes on user files deserve a look. |
Ownership and size
| Property | Meaning | Forensic notes |
|---|---|---|
System.FileOwner | The owner of the file, as known by the file system | DOMAIN\user or HOST\user. The strongest attribution field in the index, but ownership is not authorship: an admin copying a file can become its owner. |
System.Size | Size in bytes | Size at indexing time. |
Time
| Property | Meaning | Forensic notes |
|---|---|---|
System.DateCreated | Creation time of the item | Copied from the file system at indexing time. |
System.DateModified | Last modification | Same. |
System.DateAccessed | Last access | Same, and last-access updates on NTFS are often disabled or coarse. |
System.Search.GatherTime | When the gatherer last pushed the document's properties | The indexer's own clock. Not a file system timestamp, so timestomping the file does not change it. |
All four are FILETIMEs: 100-nanosecond intervals since 1 January 1601, UTC. In Windows.db the parser reads them as 8-byte little-endian values, following public research, and keeps the raw bytes next to the decoded date.
Content
| Property | Meaning | Forensic notes |
|---|---|---|
System.Search.AutoSummary | An automated summary of the full text of the document | In practice the beginning of the text. Stroz Friedberg report up to 1,024 bytes on Windows 11. |
System.Title, System.Author, System.Subject… | Document metadata from property handlers | Office documents, PDFs and emails carry extra metadata worth reading in the raw property list. |
Web and activity
| Property | Meaning | Forensic notes |
|---|---|---|
System.Link.TargetUrl | Target URL of a link / history item | On Windows 11, Stroz Friedberg found visited URLs here. |
System.ItemUrl with iehistory://{SID}/… | Web history item | The SID ties the entry to a user. |
ActivityHistory properties (StartTime, EndTime, AppId) | Activity history records | Present when System.ItemType is ActivityHistoryItem, per the same research. |
Reading the timestamps together
The gather time is the one field an attacker rarely thinks about, and it makes the others more useful.
| Pattern | Likely reading |
|---|---|
Gather time a few seconds or minutes after DateModified | The indexer picked up a fresh change. Normal for active files. |
Gather time long after DateModified | The file was indexed later: new indexed location, index rebuild, re-index, or a drive reconnected. |
DateCreated later than DateModified | Typical of a file copied or extracted with its original modification time preserved. Look for the source. |
DateModified far in the past on an executable dropped in a user-writable folder, gather time recent | Possible timestomping or an archive extraction. Check the USN journal and MFT. |
| Gather time after the last known logon of the owner | Someone or something else wrote to the location, or the indexer caught up late. |
The Windows Search Index Parser flags "recently indexed" items: indexed after their last change and within 24 hours of the newest gather time in the same database. On a machine seized shortly after an incident, that highlights what changed in the last day of activity.
Pitfalls
- Values are snapshots. Everything except gather time describes the file at the moment it was indexed. A file modified after that and never re-indexed shows stale values.
- Localisation. Display names and type texts change with the system language. Filter on
System.ItemType,System.Kindor extensions instead. - Multi-valued properties.
System.Kindand some others hold several values ("program; executable"). A parser that keeps only the first value may lose information. - Missing is not zero. A property absent from an item means no handler set it. It does not mean "empty" or "false".
- Undocumented storage. Microsoft documents the properties, not the database. How a value is encoded in
Windows.edborWindows.dbcomes from public research. When in doubt, look at the raw bytes; the parser shows every raw property for that reason.