Quick Assist

Overview

Evidence: Quick Assist Description: Collect Quick Assist History Category: System Platform: windows Short Name: qas Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Quick Assist stores browser-based history in an embedded WebView database. This data is essential for understanding remote assistance usage and potential unauthorized remote access.

Data Collected

This collector gathers structured data about quick assist.

Collection Method

This collector locates history SQLite files under user temp RemoteHelp paths, copies them, and queries visit URL, title, and visit time.

Forensic Value

This evidence is crucial for forensic investigations as it indicates when and which remote sessions or pages were accessed via Quick Assist.