I have recently blogged about windows 8.1 search history and how searched terms/phrases are recorded as LNK files in a post here. But windows also logs searched terms (search history) to the event log and web history (and cache).
From the LNK files, we know the first time a term was searched for, but not the next time or the last time it was searched, which is usually more relevant from an investigation perspective. However, this information can be obtained from the Connected-Search event log file. On disk it would be under:
\Windows\System32\Winevt\Logs\Microsoft-Windows-Connected-Search%4Operational.evtx
Under Event viewer, you can find it under:
\Applications and Services Logs\Microsoft\Windows\Connected-Search\Operational
Below is a screenshot for one such log entry.
Windows logs all URLs and reference links here. Windows, by default tries to search for everything online as well as on the machine. Even if you are offline, a search URL for online searches is generated and seen here. The screenshot below shows the same search run when machine was offline (not connected to internet).
Each time a search is run, an entry is created, sometimes multiple entries (this probably has to do with different views when browsing the search results). For searches (if machine was online), the URL requests and responses are also found in the IE web history and cache database (WebcacheV01.dat). The database is located at
\Users\<USER>\AppData\Local\Microsoft\Windows\WebCache\
The best way to study this data would be by parsing this database either manually (using libesedb and lots of data formatting with additional parsing!) or use a free program like IE10 History reader (or an expensive brand forensic tool). However, if you are just interested in the search terms without dates or other information, a raw search into the datebase files will suffice.
To find searched terms, you will need to search for URLs beginning with
https://www.windowssearch.com/search?q=
The screenshot below shows hits when searching the IE web cache files for the above URL using Encase.
To find such searches which were discarded, search for URLs beginning with
https://www.windowssearch.com/suggestions?q=
Actually, these are not the suggestions, but the lookups for term/phrase entered into the search box. The data returned (query response) will contain the suggestions.
Below is a screenshot showing the webcacheV01.dat file (and supporting db files) with search hits as displayed in Encase.
Thus there are multiple locations (connected search LNK files, event logs, web cache) where an investigator can find evidence of searches run by a user. Each has its uses and caveats.
From the LNK files, we know the first time a term was searched for, but not the next time or the last time it was searched, which is usually more relevant from an investigation perspective. However, this information can be obtained from the Connected-Search event log file. On disk it would be under:
\Windows\System32\Winevt\Logs\Microsoft-Windows-Connected-Search%4Operational.evtx
Under Event viewer, you can find it under:
\Applications and Services Logs\Microsoft\Windows\Connected-Search\Operational
Below is a screenshot for one such log entry.
 |
| Searched keyword is 'enscript' and machine was online when search was run |
Windows logs all URLs and reference links here. Windows, by default tries to search for everything online as well as on the machine. Even if you are offline, a search URL for online searches is generated and seen here. The screenshot below shows the same search run when machine was offline (not connected to internet).
 |
| Searching for 'enscript' when machine is offline |
Each time a search is run, an entry is created, sometimes multiple entries (this probably has to do with different views when browsing the search results). For searches (if machine was online), the URL requests and responses are also found in the IE web history and cache database (WebcacheV01.dat). The database is located at
\Users\<USER>\AppData\Local\Microsoft\Windows\WebCache\
The best way to study this data would be by parsing this database either manually (using libesedb and lots of data formatting with additional parsing!) or use a free program like IE10 History reader (or an expensive brand forensic tool). However, if you are just interested in the search terms without dates or other information, a raw search into the datebase files will suffice.
To find searched terms, you will need to search for URLs beginning with
https://www.windowssearch.com/search?q=
The screenshot below shows hits when searching the IE web cache files for the above URL using Encase.
 |
| Search hits in IE web cache database as seen in encase |
Search as you type
An aspect missing from LNK files and the event logs is the search suggestions and interim search results. As Rob Lee hinted to me earlier that a user could search for a term (without hitting Enter or the search button after entering the term in the search box), but not click on any results and none of the above artifacts would be created. Windows uses the 'search as you type' feature and terms windows guessed for you (as you were typing into the search box) or interim search results are discarded. However you would find some traces of the terms as windows will make online queries for the 'search as you type' feature. If this is not clear, just recall how you search with google. As you begin typing the letters of your keyword into the search box, google automatically suggests most popular searches beginning with those letters. Windows also does the same thing. |
| Google's search as you type feature |
To find such searches which were discarded, search for URLs beginning with
https://www.windowssearch.com/suggestions?q=
Actually, these are not the suggestions, but the lookups for term/phrase entered into the search box. The data returned (query response) will contain the suggestions.
Below is a screenshot showing the webcacheV01.dat file (and supporting db files) with search hits as displayed in Encase.
 |
| Search hits showing Windows querying for popular search term suggestions based on user entered input |
Thus there are multiple locations (connected search LNK files, event logs, web cache) where an investigator can find evidence of searches run by a user. Each has its uses and caveats.
No comments:
Post a Comment