Daily Blog #600: Windows 10 Search Artifacts are going to change again

Windows 10 Search Artifacts are going to change again - David Cowen - Hacking Exposed Computer Forensics Blog


Hello Reader,
            I saw this article over on the verge:

https://www.theverge.com/2019/1/16/18185490/microsoft-cortana-windows-10-search-changes

In this article they describe how Cortana is going to be separated from the search function. Currently we find the Windows 10 search artifacts in the NTUSER registry under the \software\microsoft\windows\current version\search. So keep an eye out for this change as we expect changes in how this data is stored and possibly new entries for cortana.

This is interesting since Cortana has been rapidly changing artifact wise and a return to more locally stored Cortana artifacts would be welcome. 

Post a Comment