Windows Index Search

Overview

Evidence: Windows Index Search Description: Collect Windows Index Search Database Category: System Platform: windows Short Name: indxs Is Parsed: No Sent to Investigation Hub: Yes Collect File(s): Yes

Background

Windows Search maintains an index database (Windows.edb) that catalogs file content, properties, and metadata to enable fast searching. The index contains information about files, emails (if Outlook is installed), and other indexed content.

The search index can contain remnants of deleted files, email content, and document metadata that may not be available elsewhere.

Data Collected

This collector gathers structured data about windows index search.

Windows Index Search Data

Field	Description	Example
Name	Artifact name	Windows Index Search
Type	File	File
SourcePath	Original file path	C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
Path	Relative path in evidence	Other/Windows.edb

Collection Method

This collector collects the Windows Search database from:

• ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb

• Documents and Settings\Application Data\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb (legacy path)

Forensic Value

The Windows Search index can reveal file content and metadata including indexed emails and documents. Investigators use this data to recover deleted file metadata, search indexed email content, find document keywords and properties, track user search activity, and identify files that were indexed before deletion.