Cortana History
Overview
Section titled “Overview”Evidence: Cortana History
Description: Collect Cortana History Databases
Category: Applications
Platform: windows
Short Name: crtnh
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”Cortana stores search queries, voice commands, reminders, and interaction history in ESE and IndexedDB databases. This data captures user searches and voice assistant interactions within Windows.
Data Collected
Section titled “Data Collected”This collector gathers structured data about cortana history.
Collection Method
Section titled “Collection Method”This collector gathers Cortana IndexedDB and CortanaCoreDb databases from the Cortana app package directories containing search and interaction history.
Forensic Value
Section titled “Forensic Value”Cortana history reveals user searches, questions asked, reminders set, and system queries. This provides insights into user intent, information gathering, and system usage patterns that may be relevant to investigations.