Forensic data recovery from the Windows Search Database

Abstract

including the URL of the record and the reason for the withdrawal request.This article appeared in a journal published by Elsevier. The attached copy is furnished to the author for internal non-commercial research and education use, including for instruction at the authors institution and sharing with colleagues.Other uses, including reproduction and distribution, or selling or licensing copies, or posting to personal, institutional or third party websites are prohibited. removable or encrypted drives). However, when files are deleted from the system their record is also deleted from the database. Existing tools to extract information from Windows Search use a programmatic interface to the underlying database, but this approach is unable to recover deleted records that may remain in unused space within the database or in other parts of the file system. This paper explores when unavailable files are indexed, and therefore available to an investigator via the search database, and how this is modified by the indexer scope and by attributes that control the indexing of encrypted content. Obtaining data via the programmatic interface is contrasted with a record carving

Private browsing: A window of forensic opportunity

“…A previous paper (Chivers and Hargreaves, 2011) provides an overview of the database and the reliability of records recovered by carving. This section briefly describes transaction processing, as a background to why database records are often found in log files or in cached memory such as the pagefile.…”

“…A description of the carving process and its reliability is given in (Chivers and Hargreaves, 2011); the tool is available from the author for forensic investigation, education or research.…”

“…(Jones, 2003) ) were replaced by a high performance database technology known as the Extensible Storage Engine (ESE). This database is used to support a range of other applications, including Windows Search, and was the subject of a previous paper in which we described the results of carving for deleted ESE database records from the Search Database (Chivers and Hargreaves, 2011). The carving tool is now known as ESECarve 2 and has subsequently been used to assist a number of real investigations.…”

Forensic implications of System Resource Usage Monitor (SRUM) data in Windows 8

“…2. This is an ESE (Microsoft, Extensible Storage Engine, 2012) database that Microsoft uses quite frequently on many of its products such as Exchange EDB files, Active Directory, Windows Mail, and Windows Search (Chivers and Hargreaves, 2011). The other files seen in this folder (in Fig.…”

Database forensic analysis through internal structure carving

“…SQLite had been the focus of forensic analysis particularly because it is used in Firefox Pereira (2009) and in a number of mobile device applications Pieterse and Olivier (2014). Chivers and Hargreaves (2011) investigated recovery of deleted records from the Windows Search database. OfficeRecovery provides a number of commercially sold emergency recovery tools for corrupted DBMSes OfficeRecovery (b,c,a) that support several versions of each DBMS.…”