Microsoft Edge Browser Evidence

This week I’m talking about the Windows browser some are still surprised to learn about, MS Edge. Windows 10 comes with two browsers and in this week’s podcast I’m going to go over one of them, MS Edge, and what computer forensic examiners need to know about it.

Show Notes

Below are the file paths to the Windows 1o MS Edge artifacts I mention in the podcast. Remember, I am going over the highlights in this episode and there is much more to this artifacts for those willing to do a deep dive into it. These artifacts, and the podcast discussion, are meant to help those experiencing the “Edge” as part of an investigation for the first time.

Browser History 

ROOT\Users\USERNAME\AppData\Local\Microsoft\ Windows\WebCache\WebCacheV01.dat

Favorites and ReadingList

ROOT\Users\<username\AppData\Local\Packages\ Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\ MicrosoftEdge\User\Default\DataStore\Data\nouser1\ #####\DBStore\spartan.edb 

Temporary Internet Files

ROOT\Users\\AppData\Local\Microsoft\Windows\ WebCache\WebCacheV01.dat


ROOT\Users\\AppData\Local\Microsoft\Windows\ WebCache\WebCacheV01.dat

Microsoft Edge Active Recovery 

ROOT\Users\\AppData\Local\Packages\ Microsoft.MicrosoftEdge_8wekyb3d9bbwe\AC\ MicrosoftEdge\User\Default\Recovery\Active\.dat


ROOT\Users\\AppData\Local\Packages\ Microsoft.Microsoft.Edge_8wekyb3d8bbwe\AC\#!001\ MicrosoftEdge\User\Default\WebNotes

Registry Evidence

UsrClass.dat: Local Settings\Software\Microsoft\Windows\CurrentVersion\ AppContainer\Storage\ microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge 

SDF Training Class of the Week

Learn More

Windows Prefetch Forensics

Learn More

DFSP Sponsors make the Podcast possible. Show them your love and support!

The developer of RECON – the fastest and most complete way to process Live running Macs or Mac forensic images

Makers of Insight Forensic  an all-in-one forensic data recovery and acquisition system

Check out all the classes in the SDF series – quality content at a solid training value