Cloutain / WinEDB

Windows.EDB Browser

WinEDB

Windows.EDB Browser

GUI: ==> WinEDB Latest version <==

Search Store Tree view:

Schema Info:

Command line:
==> WindowsEDB-to-CSV.ps1 <==
==> WindowsEDB-to-CSV.exe <==

Dependencies:

• .NET Framework 4.8
• Powershell Version: 5.1
• Uses Microsoft.Isam.Esent.Interop.

---

--> for research purposes ;)

---

[Note]

As of Windows 11 22H2, Windows Search data is stored in multipe SQLite3 dBs
found at 'C:\ProgramData\Microsoft\Search\Data\Applications\Windows'*
Below are some initial Queries:

• PropertyMap
• Paths (SystemIndex_1_PropertyStore) query
• SecurityDescriptor (SecStore.db) query
• Paths/Files & Timestamps (Windows-gather.db) - can be used to create a TreeView of the paths