Windows Search Index parser

[Zawadidone]

Windows Search Indexer [Microsoft Documentation] is a service which enables faster searching of files, emails, and other content on Windows systems. The service builds an index that the system refers to whenever a search is run.

Microsoft changed the structure of the Search index in Windows 11, dropping the former ESE database structure and implementing SQLite in its place. Stroz Friedberg’s research into both the old and new structures has revealed how the information in the Windows 10 Search index is mapped in the Windows 11 Search index.

References

https://www.aon.com/cyber-solutions/aon_cyber_labs/windows-search-index-the-forensic-artifact-youve-been-searching-for/
https://github.com/strozfriedberg/sidr
https://youtu.be/X4WTcRdIDAM?si=LP1tHJKQcoU5yVYT

[DevJoost]

I'm going to work on this.