Windows Search index

What it is

The Windows Search service (WSearch, process SearchIndexer.exe) crawls files, e-mails and other items to power instant search in Explorer, the Start menu and Outlook. For each item it stores properties (path, name, size, dates, owner, type) and, for many document types, a slice of the text content. Up to Windows 10 the index is a single ESE database, Windows.edb; Windows 11 stores it in SQLite databases in the same folder. The index often keeps a record of files that were later moved, renamed or deleted, and can hold content the investigator will not find elsewhere.

Location

The ESE and SQLite formats are not found side by side on the same installation. On Windows Server the Search service is not enabled by default.

What it proves

• A file existed at a path inside the indexed scope (by default the user profile folders and Start menu, the whole PC in "Enhanced" mode), with its size, owner and dates as seen by the indexer.
• Content: the auto-summary property keeps part of the text of indexed documents and scripts.
• E-mail: when Outlook uses Windows Search, messages and attachments are indexed with sender, subject and body extracts.
• Browsing: Internet Explorer and legacy Edge history, and on Windows 11 some URLs through link properties.
• Deleted items: records of files that were removed can survive in the database, its free pages, logs or WAL.
• It does not prove that a user opened or viewed an item: indexing is an automatic system activity.

Key fields

Timestamps

Retention and clearing

• The index follows the file system: when an item is deleted or leaves the indexed scope, its record is eventually removed. Remnants can remain in ESE free pages and MSS*.log files, and in the SQLite -wal file and freelist on Windows 11.
• "Rebuild index" in Indexing Options, stopping or disabling WSearch, or deleting the database erase the current index. A rebuild is visible through a new database with recent file times.
• Older copies of the index are often available in volume shadow copies, which makes it possible to compare what was indexed at different dates.
• A copy taken from a running system is usually in "dirty shutdown" state: replay the logs (esentutl /r) on a copy before parsing if the tool requires a clean database.

Collection

• KAPE target: WindowsIndexSearch (system index folder, per-user indexes and GatherLogs).
• Velociraptor (Windows.Triage.Targets): WindowsIndexSearch.
• Built-in: the databases are locked by SearchIndexer.exe; copy through a shadow copy, collect the logs as well, then work on the copy:

esentutl.exe /y "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" /vss /d E:\case\search\Windows.edb
cd /d E:\case\search
esentutl.exe /mh Windows.edb
esentutl.exe /r MSS

/mh shows the database state (clean or dirty shutdown); /r MSS replays the MSS*.log files that must be copied into the same folder. On Windows 11, copy Windows.db, Windows-gather.db and their -wal/-shm files together, the same way.

Parsing tools

• SIDR (Search Index Database Reporter, Stroz Friedberg, open source): parses both ESE and SQLite indexes into file, internet history and activity history reports (CSV or JSON).
• ESEDatabaseView (NirSoft, free): browses Windows.edb tables.
• libesedb (Joachim Metz, open source): esedbexport dumps every ESE table, including from damaged databases.
• Thumbcache Viewer: loads the index to map thumbcache IDs to file paths.
• Any SQLite browser opens the Windows 11 databases; merge the WAL into a copy first (see SQLite WAL).

Investigation tips

• Search the property store for file names from the case (exfiltrated documents, tools, ransom notes): a hit shows the file existed at that path at indexing time, even if the $MFT no longer knows it.
• Read the auto-summary of deleted documents and scripts: it can recover content the attacker removed.
• Combine gather times with the USN journal to date when files appeared and disappeared.
• On Windows 11, look at the -wal file before it is checkpointed: it can contain recently deleted records.
• Carve Windows.edb and unallocated space for ESE pages (file carving) when records have been purged.
• Remember that indexing is automatic: attribute user access with LNK files, Jump Lists or ShellBags.