This ESE database can be interpreted by EseDbViewer, ESEDatabaseView or Joachim Metz excellent esedbexport tool.
\Users\user_name\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat. \Users\ user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxx\AC\MicrosoftEdge\User\Default\Recovery\Active\īeing Microsoft there is ofcourse a legacy version of IE (version 11) included in Windows 10 (just in case you don’t like the new browser) and interestingly enough both Edge and IE history records are stored in the same database:. 
The Edge last active browsing session is stored in the following directory:
\Users\user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxx\AC\#!001\MicrosoftEdge\Cache\. The Edge cached files stored in the following directory: In any case this database stores the following tables: Note the naming convention of this database - it seems strange that Microsoft didn’t bother to rename this file when they renamed the browser itself. \Users\user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxx\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\xxxxx\DBStore\spartan.edb. The Edge settings are stored in the following ESE databse: In fact most of the Edge artefacts are stored in ESE databases. Since IE10 browsing history records are no longer stored in Index.DAT files, but are instead stored in an Extensible Storage Engine (ESE) database format, and Microsft Edge is no different. As such I expected that the actual forensic artefacts would be in a new or different format from Internet Explorer (IE) version 11. 
Microsoft Edge, previously known as “Spartan” is an all new “universal” Microsoft application, which encompasses a new rendering engine. Following on from my recent Cortana blog I have decided to highlight another Windows 10 component, the new Microsoft Edge web browser.
0 kommentar(er)
