I've spent 2 days looking for emails and movie files that just don't seem to exist. I was starting to think that perhaps it just wasn't there but then I ran a keyword search for derogetory expressions and found a lot of results in the Windows.edb file. Apparently this file is an index of the file system? I'm seeing some obvious file name with extentions in here AND some code around the file names which I'm hoping will translate into date/time.
Does anyone know anything about this file and perhaps have any ideas on how to parse it into a format that is readable?
EDB files are Microsoft Exchange database files. Plenty of tools to read them, convert them to PST files, etc.
Typically that is the case but this EDB file is not. It apparently is WindowsXP's index file which happens to have the same extention.
Sorry, I mis-read your initial post. You are writing about the Windows Search index Windows.edb file, not a Windows edb file. Have you tried a SQL query using the ISearchQueryHelper?
See MSDN - http//
This program will read and extract the content of the Windows.edb file
The content of this file can provide useful intelligence.
Another one
http//
Or, if you are a programmer
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=3110
http//
jaclaz
Chitapett, John Douglas of QCC Information Security has done a lot of research in to Windows Search Index and its .edb files. He's recently written a paper on this area so it may be worth your while getting in touch with him.
Chitapett, John Douglas of QCC Information Security has done a lot of research in to Windows Search Index and its .edb files. He's recently written a paper on this area so it may be worth your while getting in touch with him.
Thanks Jonathan
Anyone know how to contact John Douglas? Also, I looked into the two tools suggested on this post for parsing windows.EDB index files but they are pretty expensive. Anyone know of a cheaper product?
Chitapett,
Check your PM.
Regards,
James
The Windows Search Indexer just uses the Esent database, the same as the latest Windows Live Messenger (and Exchange server). Esent is an inbuilt Windows transactional database engine.
More info http//
Try EseDbViewer, which has specific modes for both Windows Search Indexer and Windows Live Messenger and a generic mode which will open any Esent database.
http//