EventTranscript DB

Overview

Evidence: EventTranscript DB Description: Collect EventTranscript DB Category: System Platform: windows Short Name: evnttrscdb Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): Yes

Background

EventTranscript.db is a SQLite database maintained by Windows for diagnostic data and telemetry. It contains detailed information about application inventory, browser history, WiFi connections, device installations, and other system events.

This database provides unique forensic artifacts not available in other Windows logs, including granular application usage data, WiFi access point history, and detailed system inventory information.

Data Collected

This collector gathers structured data about eventtranscript db.

EventTranscript DB Data

Field	Description	Example
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
AccessTime	URL access timestamp	2023-10-15T14:30:00
URL	Visited URL	https://www.example.com
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
ProgramName	Application name	Google Chrome
InstallPath	Installation path	C:\Program Files\Google\Chrome
OSVersion	OS version at install time	10.0.19041
InstallDate	Installation timestamp	2023-10-01T10:00:00
Version	Application version	118.0.5993.89
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
AccessTime	Scan timestamp	2023-10-15T14:30:00
SSID	WiFi network name	Corporate-WiFi
MACAddress	Access point MAC address	00:11:22:33:44:55
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
DeviceMake	Device manufacturer	Dell Inc.
DeviceModel	Device model	Latitude 7490
TimeZone	User time zone	America/New_York
DefaultBrowser	Default browser ProgID	ChromeHTML
DefaultApp	Default app for file types
DeviceId	Device identifier	\.\PHYSICALDRIVE0
SerialNumber	Disk serial number	S4BXNX0N123456
Size	Disk size in bytes	512110190592
NumPartitions	Number of partitions	4
BytesPerSector	Bytes per sector	512
MediaType	Media type	SSD
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
InterfaceGuid	Network interface GUID	{12345678-1234-1234-1234-123456789ABC}
InterfaceType	Interface type	71
InterfaceDescription	Interface description	Intel(R) Wireless-AC 9560
SSID	Connected WiFi network	Corporate-WiFi
AuthAlg	Authentication algorithm	WPA2PSK
BSSID	Access point MAC address	00:11:22:33:44:55
Manufacturer	AP manufacturer	Cisco
ModelName	AP model name	AIR-AP2802I
ModelNumber	AP model number	AP2802I
SID	User security identifier	S-1-5-21-...
Username	Username	DOMAIN\user
ObjectID	Device object identifier	PCI\VEN_8086&DEV_9D60
Service	Associated service	nvme
FirstInstallDate	First installation	2023-01-15T10:00:00
InstallDate	Last installation	2023-10-01T14:00:00
Model	Device model	Samsung SSD 970 EVO
Manufacturer	Device manufacturer	Samsung
SID	User security identifier	S-1-5-21-...
UserName	Username	DOMAIN\user
TimeStamp	Event timestamp	2023-10-15T14:30:00.123Z
ProducerId	Producer ID	123
Producer	Producer name	Microsoft-Windows-Kernel-General
ProviderGroupId	Provider group ID	45
ProviderGroupGUID	Provider group GUID	{A68CA8B7-004F-D7B6...}
LocaleName	Locale name	en-US
TagName	Event tag name	BrowserHistory
TagId	Event tag ID	1
FullEventName	Complete event name	Microsoft.Windows.Shell.SystemSettings.AppDefaultsUpdated
LoggingBinaryName	Logging binary	SystemSettings.exe
FriendlyLoggingBinaryName	Friendly binary name	System Settings
FullEventNameHash	Event name hash	12345678901234567890
Keywords	Event keywords	0x8000000000000000
IsCore	Is core event	true
CompressedSize	Compressed payload size	1024
Payload	JSON payload data	{"AppId":"MSEdge","Url":"https://..."}

Collection Method

This collector:

• Collects the EventTranscript database from ProgramData\Microsoft\Diagnosis\EventTranscript

• Opens the SQLite database

• Queries specific event types using SQL

• Parses JSON payloads from event records

• Extracts and structures data into separate tables

• Also exports raw event data organized by tags to CSV files

Forensic Value

EventTranscript provides unique telemetry data not available in traditional Windows logs. Investigators use this for historical browser activity tracking, application installation timelines, WiFi network history and geolocation, device installation tracking, user behavior patterns, and system configuration analysis.