Touch Screen Lexicon Forensics (TextHarvester/WaitList.dat)

‘WaitList.dat’ (WaitList) is a data file which has been found to contain stripped full body text from email, contact and document files.

Hi All,

I have just posted some research into the (to my knowledge) undocumented Windows data structure 'WaitList.dat'. I have also written a parser to extract email, document and contact indexes from this file.

If you are interested, please head to my blog and have a read
https://b2dfir.blogspot.com.au/2016/10/touch-screen-lexicon-forensics.html