Investigating Microsoft Edge Web Browser and Application
17/05/2021 Monday
Microsoft Edge web browser, currently known as Microsoft Edge Legacy, is an EdgeHTML-based browser developed by Microsoft. EdgeHTML is a software browser engine that was first introduced as rendering engine part of Internet Explorer 11. Then, it was used in the project Spartan web browser and was later named Microsoft Edge. Microsoft Edge Windows application is a browser application that was built based on the Microsoft Edge web browser.
Digital Forensics Value of Microsoft Edge Artifacts
Web browsers’ data can be critical to a digital investigation since they serve as a user's window and access point to the web and the rest of the world. Web browsers have become part of our daily lives, thus, they can reveal a significant amount of information about a user’s internet activities, synced devices, and accounts. As it stores data of every website visited, every search conducted, every image viewed, and so much more.
Location of Microsoft Edge Artifacts
Edge web browser stores its files and folders at the following locations:
C:\Users\%username%\AppData\Local\Packages\%packagename%\AC\MicrosoftEdge\User\%profilename%.default
C:\Users\%username%\AppData\Local\Packages\%packagename%\AC\MicrosoftEdge\User\%profilename%\Favorites
C:\Users\%username%\AppData\Local\Packages\%packagename%\AC\MicrosoftEdge\User\%profilename%\Recovery
C:\Users\%username%\AppData\Local\Packages\%packagename%\AC\MicrosoftEdge\User\%profilename%\Datastore
C:\Users\%username%\AppData\Local\Packages\%packagename%\AC\INetCookies
C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache
C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
Structure of Microsoft Edge Artifacts
Edge stores its cache, history, and downloads in the 'WebCacheV01.dat' ESE database within different containers. It also stores its session data in (.dat) files in the 'Recovery' folder. For the newer versions of Edge, bookmarks are stored in the 'spartan.edb' ESE database and cookies are stored in the 'WebCacheV01.dat' ESE database within specified containers although the older versions of Edge bookmarks are stored in in separate Internet Shortcut (.url) files in the 'Favorites' folder and cookies are stored in text files in locations specified within the ESE database.
Analyzing Microsoft Edge Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to extract Microsoft Edge web browser and Microsoft Edge Windows application artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Parser Selection Phase, you can select Microsoft Edge artifacts:
ArtiFast can analyze Microsoft Edge cache, cookies, downloads, favorites, history, dependency entries, periodic history, reading list, and web notes for both Edge web browser and Edge Windows application. For demonstration purposes, all artifacts have been chosen but you have the option to parse artifacts individually as well.
Once ArtiFast parser plugins complete processing the artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Microsoft Edge web browser and Microsoft Edge Windows application artifacts in ArtiFast software.
Edge Cache Artifact
This artifact contains the cached entries related information from Microsoft Edge browser and Windows application. The details you can view include:
- Creation Date/Time - The date and time when the cached entry was created.
- Last Accessed Date/Time - The date and time when the cached entry was last accessed.
- Last Modified Date/Time - The date and time when the cached entry was last modified.
- Expiry Date/Time - The date and time when the cached entry expires.
- Access Count - The number of times the cache file was accessed.
- File Name - Represents the cache file name.
- File Size - The size of the cache file.
- Content Type - The type of cache file.
- Full Path - Full Path.
- Relative Path - Relative Path.
- URL - URL.
- Is Deleted - Indicates whether the file was deleted.
- Last Synchronized Date/Time - The last synchronization date and time.
- Response Headers - Response headers.
Edge Cookies Artifact
Microsoft Edge Cookies contains information about all of the cookies saved to the browser such as:
- File Creation Date/Time - The date and time when the file was created.
- File Modification Date/Time - The date and time when the file was modified.
- File Access Date/Time - The date and time when the file was accessed.
- Cookie Expiry Date/Time - The date and time when the cookie will expire.
- Cookie Last Access Date/Time - The date and time when the cookie was last accessed.
- Cookie File - Cookie file.
- Cookie Maximum Age - Cookie maximum age in seconds.
- Cookie Name - The name of the cookie.
- Cookie Value - The value of the cookie.
- File Access Count - The number of times the cookie file was accessed.
- File Size - The size of the cookie file.
- Number of Cookies in The File - Indicates the number of cookies in the file.
- URL - Cookie URL.
- User Profile - User profile.
Edge Downloads Artifact
Microsoft Edge Downloads contains information about the downloaded files from Edge web browser and application. The details you can view include:
- Download Date/Time - The download date and time.
- URL - The file download URL.
- File Name - The name of the downloaded file.
- Temp Location - The temporary location for the downloaded file.
- Redirect URL - URL of the redirected webpage.
- Download Location - The download location.
- Content Type - The type of downloaded file.
Edge Favorites Artifact
This artifact contains information about the favorited webpages. The details you can view include:
- Creation Date/Time - The date and time when the favorite was added.
- Modified Date/Time - The date and time when the favorite was modified.
- URL - The URL of the favorite webpage.
- Title - The title of the favorite webpage.
- Icon File - The favorite Icon file.
- Base URL - Favorite Base URL.
Edge History Artifact
The Edge History artifact contains information about the visited URLs from Edge browser profile. The details you can view include:
- Visit Date/Time - The date and time when the URL was visited.
- Visit Count - The number of times that the user has visited the URL.
- URL - The visited URL.
- Redirect URL - URL of the redirected webpage.
- File Name - File name.
- Profile Name - User profile name.
Edge Dependency Entries Artifact
This artifact contains information about the dependency entries from Microsoft Edge browser. The details you can view include:
- Modified Date/Time - The date and time when the entry was modified.
- Port - Port.
- URL - The URL of the webpage.
- Host Name - Host name.
Edge Periodic History Artifact
This artifact contains information about the periodic history from Microsoft Edge browser. The details you can view include:
- Visit Date/Time - The date and time when the URL was visited.
- Visit Count - The number of times that the user has visited the URL.
- URL - The visited URL.
- Redirect URL - URL of the redirected webpage.
- File Name - File name.
- Profile Name - User profile name.
Edge Reading List Artifact
This artifact contains information about the reading list from Microsoft Edge Windows application. The details you can view include:
- File Creation Date/Time - The date and time when the file was created.
- URL - The URL of the webpage.
- Host Name - Host name.
- Title - The title of the favorite webpage.
Edge Web Notes Artifact
This artifact contains information about the web notes from Microsoft Edge Windows application. The details you can view include:
- Visit Date/Time - The date and time when the URL was visited.
- Visit Count - The number of times that the user has visited the URL.
- URL - The visited URL.
- Redirect URL - URL of the redirected webpage.
- File Name - File name.
- Profile Name - User profile name.
