Information about files downloaded with Microsoft Edge is available in the History SQLite database. We need the cookies table, here is the query: Microsoft Edge cookiesĪs you can see, we can easily convert timestamps in WebKit format with datetime function. You can easily parse these files with ChromeCacheView by NirSoft: Microsoft Edge cache parsed with ChromeCacheViewĬookies are stored in an SQLite database called Cookies. The timestamps are stored in WebKit format – a 64-bit value for microseconds since 00:00 UTC.Ĭache is stored in the Cache subfolder and consists of an Index file ( index ), Data Block files ( data_# ) and data files ( f_# ).
They are stored in a JSON file with the same name – Bookmarks. Let’s start from bookmarks or “favorites”. On Windows, Edge data is available under the following location:Ĭ:\Users\%USERNAME%\AppData\Local\Microsoft\Edge\User Data\Default What’s more, the browser is available not only for Windows, but also for macOS, Android and iOS.
Of course, it may have a similar set of forensic artifacts to Chromium or Chrome, but we must check it anyway. Recently Microsoft finally released the Chromium-based version of Edge Browser, so it seems we’ll miss ESE databases soon (not).
0 kommentar(er)
