312-49 · Question #660
Where should the investigator look for the Edge browser's browsing records, including history, cache, and cookies?
The correct answer is A. ESE Database. The legacy version of Microsoft Edge (EdgeHTML-based, pre-Chromium) stored browsing artifacts - including history, cache, cookies, and favicons - in ESE (Extensible Storage Engine) database files, which use the .edb format. ESE is the same database engine used by Active…
Question
Where should the investigator look for the Edge browser's browsing records, including history, cache, and cookies?
Options
- AESE Database
- BVirtual Memory
- CSparse files
- DSlack Space
How the community answered
(35 responses)- A86% (30)
- B6% (2)
- D9% (3)
Explanation
The legacy version of Microsoft Edge (EdgeHTML-based, pre-Chromium) stored browsing artifacts - including history, cache, cookies, and favicons - in ESE (Extensible Storage Engine) database files, which use the .edb format. ESE is the same database engine used by Active Directory and Exchange. Forensic tools like ESEDatabaseView can parse these files. Virtual memory and slack space are general storage areas not specific to browser records, while sparse files are a filesystem concept unrelated to browser data storage.
Topics
Community Discussion
No community discussion yet for this question.