Skip to content
Search IndexParser

Series

Windows Search index fundamentals

5 posts in this series. Read them in order or jump to any one.

  1. Windows Search Index Forensics: The Complete Guide

    What the Windows Search index records, where Windows.edb and Windows.db live, what survives file deletion, and how to analyse both formats in a DFIR case.

  2. Windows.edb vs Windows.db: Windows 10 vs 11 Search Index

    How the Windows Search index moved from the ESE Windows.edb of Windows 10 to the SQLite Windows.db of Windows 11: tables, layout, WAL and DFIR impact.

  3. Windows Search Index Properties Explained for DFIR

    System.ItemPathDisplay, System.Search.GatherTime, System.Search.AutoSummary and the other Windows Search properties that matter in an investigation.

  4. ESE Database Forensics: Basics for Investigators

    How an ESE (JET Blue) database like Windows.edb is built: header, pages, B+-trees, catalog, tagged columns, long values, compression and deleted records.

  5. Windows.db Forensics: SQLite, WAL and Gather Database

    Windows 11 search index forensics: how Windows.db, Windows.db-wal and Windows-gather.db fit together, what the WAL reveals, and how not to destroy it.

All posts in this series