Windows Index Search
Overview
Section titled “Overview”Evidence: Windows Index Search
Description: Collect Windows Index Search Database
Category: System
Platform: windows
Short Name: indxs
Is Parsed: No
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Windows Search keeps an index of file names, paths, and metadata. Windows 10 and Windows Server 2019 and earlier store that index in the ESE database Windows.edb. Windows 11 and Windows Server 2022 store it in the SQLite databases Windows.db and Windows-gather.db.
Windows.db holds item properties. Windows-gather.db holds indexed names and the folder tree. A system upgraded to Windows 11 can still have Windows.edb. Every format that is present is collected. Windows-usn.db is not collected.
File names and rebuilt paths from the gather tables are a separate evidence type: Windows Index Search Parsed.
Data Collected
Section titled “Data Collected”The collector records one row for each database file it copies, and copies that file into the evidence.
windows_search_collected_files
Section titled “windows_search_collected_files”| Field | Description | Example |
|---|---|---|
path | Original file path | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db |
size | File size in bytes | 1208844288 |
creation_time | File creation time (UTC) | 2024-11-09 02:54:32+00 |
access_time | File last access time (UTC) | 2024-11-09 02:54:32+00 |
write_time | File last write time (UTC) | 2024-11-09 02:54:32+00 |
collection_method | OS for a normal copy, NTFS when the file was read through raw NTFS | OS |
Collection Method
Section titled “Collection Method”On every drive, the collector copies these files from ProgramData\Microsoft\Search\Data\Applications\Windows when they exist:
Windows.edbWindows.db,Windows.db-wal, andWindows.db-shmWindows-gather.db,Windows-gather.db-wal, andWindows-gather.db-shm
Windows Search often keeps these files open. When a normal copy fails, the file is read through raw NTFS.
This evidence is included in the full acquisition profile. The quick profile does not copy the raw databases. It includes Windows Index Search Parsed instead.
Forensic Value
Section titled “Forensic Value”The index can show files, folders, and metadata that were present even after the originals were deleted. Use the copied databases when the investigation needs item properties that the parsed file list does not include.