Windows Search Artifacts [in progress] - nurit-cyber/OperatingSystemForensics GitHub Wiki

Table of Contents

Explorer File Searches

File explorer searches will be stored into the Windows Registry & tied to the specific user:

Cortana searches are not stored in the same place in the Windows Registry

Windows 7+: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

Searching with 'Charms'

Search history: what keyword/phrase was searched and when?
Location:
\Users\[username]\AppData\Local\Microsoft\Windows\ConnectedSearch\History
txt_*********.langcode.lnk