Windows Search Artifacts [in progress] - nurit-cyber/OperatingSystemForensics GitHub Wiki
Table of Contents
Explorer File Searches
File explorer searches will be stored into the Windows Registry & tied to the specific user:
Cortana searches are not stored in the same place in the Windows Registry
Windows 7+: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
Searching with 'Charms'
Search history: what keyword/phrase was searched and when?
Location:
\Users\[username]\AppData\Local\Microsoft\Windows\ConnectedSearch\History
txt_*********.langcode.lnk