Windows Index Search Parsed
Overview
Section titled “Overview”Evidence: Windows Index Search Parsed
Description: Parse Windows Index Search Database
Category: System
Platform: windows
Short Name: indxsp
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Windows Search records each indexed item in SystemIndex_Gthr and the folder tree in SystemIndex_GthrPth. Windows 10 and Windows Server 2019 and earlier keep both tables in the ESE database Windows.edb. Windows 11 and Windows Server 2022 keep them in the SQLite database Windows-gather.db.
Each item stores its name and the identifier of its folder. Walking that folder chain rebuilds the full path. The raw databases are collected separately by Windows Index Search.
Data Collected
Section titled “Data Collected”windows_search_parsed
Section titled “windows_search_parsed”| Field | Description | Example |
|---|---|---|
source_path | Database the row came from | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows-gather.db |
document_id | Indexed item identifier | 42 |
scope_id | Folder identifier used to rebuild the path | 7 |
file_name | Indexed file or folder name | notepad.exe |
full_path | Path rebuilt from the folder tree | C:\Windows\System32\notepad.exe |
last_modified | Last modified time stored in the index (UTC) | 2025-07-01 06:10:54+00 |
Items stored with a file: scheme become Windows paths. Other schemes keep their URL form, such as a winrt:// entry for a packaged application.
Collection Method
Section titled “Collection Method”The collector reads the gather tables from ProgramData\Microsoft\Search\Data\Applications\Windows on every drive:
Windows.edbis read in place through raw NTFS, so the locked database is not copied by this evidence.Windows-gather.dband its-walfile are copied to a temporary directory and queried there.
If both databases exist, both are parsed. source_path shows which file a row came from. A machine upgraded to Windows 11 can still have Windows.edb, so both formats are read when present.
This evidence is included in the full and quick acquisition profiles. The raw database files are collected only by Windows Index Search, which is included in the full profile.
Forensic Value
Section titled “Forensic Value”The rebuilt paths show which files the index knew about, including items whose originals are gone. Item properties beyond the path remain in the raw Windows.edb or Windows.db file.
- If
Windows-gather.db-walcannot be copied, rows from the main database are still written, and the newest items in the WAL can be missing. - Only the gather tables are parsed. Item properties in
Windows.dband in theWindows.edbproperty store are not parsed. Windows.edbis read while Windows Search may still be writing to it, so the newest changes can be missing.- What appears in the index depends on the folders Windows Search was configured to index.