Cortana History

Overview

Evidence: Cortana History Description: Collect Cortana History Databases Category: Applications Platform: windows Short Name: crtnh Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

Cortana stores search queries, voice commands, reminders, and interaction history in ESE and IndexedDB databases. This data captures user searches and voice assistant interactions within Windows.

Data Collected

This collector gathers structured data about cortana history.

Collection Method

This collector gathers Cortana IndexedDB and CortanaCoreDb databases from the Cortana app package directories containing search and interaction history.

Forensic Value

Cortana history reveals user searches, questions asked, reminders set, and system queries. This provides insights into user intent, information gathering, and system usage patterns that may be relevant to investigations.