GitHub - dfirdetective/WinSearchAppCache: Windows Search App Cache parsing · GitHub

https://github.com/dfirdetective/WinSearchAppCache • 269 KB fetched
Open original page

GitHub - dfirdetective/WinSearchAppCache: Windows Search App Cache parsing · GitHub

Skip to content

Navigation Menu

Sign in Appearance settings

* Platform
* AI CODE CREATION
* GitHub Copilot Write better code with AI

* GitHub Copilot app Direct agents from issue to merge

* MCP Registry Integrate external tools

* DEVELOPER WORKFLOWS
* Actions Automate any workflow

* Codespaces Instant dev environments

* Issues Plan and track work

* Code Review Manage code changes

* Code Quality Enforce quality at merge

* APPLICATION SECURITY
* GitHub Advanced Security Find and fix vulnerabilities

* Code security Secure your code as you build

* Secret protection Stop leaks before they start

* EXPLORE
* Why GitHub

* Documentation

* Blog

* Changelog

* Marketplace

View all features

* Solutions
* BY COMPANY SIZE
* Enterprises

* Small and medium teams

* Startups

* Nonprofits

* BY USE CASE
* App Modernization

* DevSecOps

* DevOps

* CI/CD

* View all use cases

* BY INDUSTRY
* Healthcare

* Financial services

* Manufacturing

* Government

* View all industries

View all solutions

* Resources
* EXPLORE BY TOPIC
* AI

* Software Development

* DevOps

* Security

* View all topics

* EXPLORE BY TYPE
* Customer stories

* Events & webinars

* Ebooks & reports

* Business insights

* GitHub Skills

* SUPPORT & SERVICES
* Documentation

* Customer support

* Community forum

* Trust center

* Partners

View all resources

* Open Source
* COMMUNITY
* GitHub Sponsors Fund open source developers

* PROGRAMS
* Security Lab

* Maintainer Community

* GitHub Stars

* Archive Program

* REPOSITORIES
* Topics

* Trending

* Collections

* Enterprise
* ENTERPRISE SOLUTIONS
* Enterprise platform AI-powered developer platform

* AVAILABLE ADD-ONS
* GitHub Advanced Security Enterprise-grade security features

* Copilot for Business Enterprise-grade AI features

* Premium Support Enterprise-grade 24/7 support

* Pricing
Search /

Sign in
Sign up Appearance settings

You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

dfirdetective

/

WinSearchAppCache

Public

*
Notifications
You must be signed in to change notification settings

*
Fork
5

*

Star
10

*

Code

*

Issues
0

*

Pull requests
0

*

Actions

*

Projects

*

Security and quality
0

*

Insights

Additional navigation options

*

Code

*

Issues

*

Pull requests

*

Actions

*

Projects

*

Security and quality

*

Insights

main

Branches Tags

Go to file

Code Open more actions menu

Latest commit
 

History
17 Commits
17 Commits

Folders and files
Name Name Last commit message
Last commit date

AppCacheParse.py

AppCacheParse.py

 
 

LICENSE

LICENSE

 
 

README.md

README.md

 
 

View all files

Repository files navigation

*

* README

* MIT license

More items

WinSearchAppCache

While working through an interview process, I came across the old Microsoft.Windows.Cortana artifacts and wondered what they would look like on my personal computer that I had never configured or given permissions to Cortana. I found a directory named DeviceSearchCache and AppCache#.txt. Within the text file, I found some data that wasn't available in other artifacts or that was different from other artifacts. As a result, I wrote a simple script to parse out the JSON data to a CSV with slightly cleaner headers for easier sorting.

Here is where I'll put my notes and script so far. This is ongoing research and development - very much a work in progress.

Basic Info AppCache#.txt

C:\Users%USERNAME%\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache[##################].txt

The numbers at the end of the filename are the Windows filetime stamp of the iteration of AppCache. It writes numerous times throughout the day, however, it is not consistent to the hour.

The file is in JSON format and not locked - so easily copied out while running.

Actual Data and Hypotheses

Headers
Sample
Hypothesis

System.FileExtension
{'Value': '.exe', 'Type': 12}
The file extension for the indexed file.

System.Software.ProductVersion
{'Value': '1.0.4.0', 'Type': 12}
If available, the product version for the application.

System.Kind
{'Value': 'program', 'Type': 12}
Program, document, link, and unknown are the options.

System.ParsingName
{'Value': 'Chrome', 'Type': 12}
Anything from app name, to full path, to an AutoGenerated GUID

System.Software.TimesUsed
{'Value': 221, 'Type': 5}
Does not match other artifacts like prefetch run count

System.Tile.Background
{'Value': 4280291898 , 'Type': 5}
Unsure, may be whether the app also runs in the background?

System.AppUserModel.PackageFullName
{'Value': 'Microsoft.BingWeather_4.53.41681.0_x64 __8wekyb3d8bbwe', 'Type': 12}
Full name

System.Identity
{'Value': 'Microsoft.BingWeather_8wekyb3d8bbwe', 'Type': 12}
Short name

System.FileName
{'Value': 'vmware', 'Type': 12}
Actual filename without extension

System.ConnectedSearch.JumpList
List of values, in Screenshot
Contains jumplists for some apps that don't have jumplists in the normal location

System.ConnectedSearch. VoiceCommandExamples
Unknown
Not sure yet, all my rows were blank.

System.ItemType
Trusted Immersive
Options on my machine are "Trusted Immersive", "Immersive", or "Desktop"

System.DateAccessed
133022364739230000
Date of access in Windows Filetime - not last access for all

System.Tile.EncodedTargetPath
C:\Users\%USERNAME%\AppData\Local\Programs\Python\Python310\pythonw.exe
May be full file path or same as ParsingName

System.Tile.SmallLogoPath
images\logo.png
Mostly Windows services have this, looks like part of path to the logo/icon image

System.ItemNameDisplay
GitHub Desktop
Basic application display name.

Additional Notes:

As I messed with the files in the live folder, they would stop being deleted by the system and the "TimesUsed" and "DateAccessed" columns are zeroed out in future captures. I think if the file is open or edited before next write, the system just creates a new one and loses the count somewhere. I started with one AppCache file at the start of me research and now I have 5 of them and all 5 have empty "TimesUsed" and "DateAccessed" columns.

If the value contains "Points: ", that appears consistent with the "Interaction Count" in the automatic jumplists.

If ParsingName starts with 6D809377-6AF0-444B-8957-A3773F02200E or 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E that seems to refer to the folder C:\Program Files (x86)\ . Confirmed by both registry folder values ( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions ) and looking at the full path of the executable. If it starts with 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7 or D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27 that seems to refer to System32 or SysWOW64. Last, if it starts with F38BF404-1D43-42F2-9305-67DE0B28FC23 , it is located in the C:\Windows folder.

It appears that Tile.Background has a common value of 16777215 on my machine for most applications and then some Windows applications have other larger values.

It appears that the "Type:" is based on what data is in the containing field.

Type
Hypothesis

0
list of lists of files/directories

1
list of Name, Path, Description data for directories and document type files (.txt, .docx, .csv, .pdf, or files opened in a text editor, ex: hex views of other filetypes)

2
list containing Name, Path, Description data for directories and any other filetype (ex: .py, .lnk, cloud files)

3
list of Type 2 data that appears to match CustomDestination jumplist data/style with plaintext titles as they appear on hover

4
list of "Frequent", "Recent", "Recently Closed" data of Type 1 or 2

5
an integer

12
a string

Values that don't exist in Jumplists:

Adobe Acrobat recent file list

Browser recently closed tabs/windows titles (not the website URL but like "Discord", "One Drive", etc.) - combine with CustomDestinations Jumplist for links

Slack data identifies the "Workspaces" by name in the list - Ex: "SANS Cyber42" (Similar to browsers, combine with CustomDest for link data)

Display names for entries that are unclear in jumplists (Ex: CCleaner shows "AUTOJL" in jumplists but "Run CCleaner" in AppCache)

Some Microsoft programs have jumplist entries but not defined - the options are defined in AppCache (Ex: Snip&Sketch has entries in jumplists but none in plaintext, AppCache has "Take a new snip, New snip in 3 seconds, New snip in 10 seconds" as entries

File Explorer has an entry that includes last visted directories and the date of visit and possible # of unique visits (requires additional testing)

Some apps provide additional data - Ex: PyCharm shows specific .py within a project file where jumplist just shows the general project file

However, I don't see files opened in Browsers in AppCache but that data is in jumplists.

Settings Cache

Appears to be default data related to searches that would call Windows data, troubleshooters, and system settings. Not every row has entries in every column and the parser for this breaks at the same row every time I run it and I haven't had time to troubleshoot yet.

Parsed SettingsCache-output.csv will be INCOMPLETE .

Headers are:

ParsingName, ActivationContext, SmallLogoPath, PageID, SettingID, HostID, Condition, Comment, and HighKeywords

Headers
Sample
Hypothesis

ParsingName
Classic_{1498BF43-8A3E-4B9C-917B-C419E4501A62}.settingcontent-ms
File identifier

ActivationContext
%windir%\system32\msdt.exe -id NetworkDiagnosticsInbound -ep CortanaSearch
What is offered/returned

SmallLogoPath
%windir%\diagnostics\system\Networking\DiagPackage.dll,-20004
Path to a logo

PageID
C58C4893-3BE0-4B45-ABB5-A63E4B8C8651
Registry - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\ - Identifies as "Troubleshooting"

SettingID
1498BF43-8A3E-4B9C-917B-C419E4501A62
Matches the ParsingName alphanumerics

HostID
12B1697E-D3A0-4DBC-B568-CCF64A3F934D
Only two unique values through the list

Condition
shcond://v1#IsServer;1
Windows Shell conditions cached?

Comment
Find and fix problems with Windows Firewall
Default text that pops up in search when you search related keywords

HighKeywords
windows firewall troubleshooter;troubleshoot windows firewall;troubleshoot firewall;network troubleshooter;troubleshoot network;fix firewall;fix network;network issues;network problems;firewall issues;firewall problems;incoming connections;inbound connections;troubleshooters
Keywords for Search optimizing?

Script Info

I will be continuing to work on this as time allows. It is intended only for my research purposes at this time. You can run it from any folder on a Windows machine and it should pull the DeviceSearchCache folder contents from the host machine and copy it to a folder within the working directory along with the CSVs of simply parsed data. The ConnectedSearch.Jumplists needs more parsing but I wanted a quick way to pull on different machines so I could just copy one folder over. I am running this on Python 3.10.4.

About
Windows Search App Cache parsing
Resources
Readme
MIT license
Activity
Stars
10 stars
Watchers
2 watching
Forks
5 forks
Report repository

Releases

Packages

Contributors

Languages

Footer

(c) 2026 GitHub, Inc.

Footer navigation

*
Terms

*
Privacy

*
Security

*
Status

*
Community

*
Docs

*
Contact

*

Manage cookies

*

Do not share my personal information

You can’t perform that action at this time.

Links found on this page

1. Skip to content [direct]
2. Sign in [direct]
3. GitHub Copilot Write better code with AI [direct]
4. GitHub Copilot app Direct agents from issue to merge [direct]
5. MCP Registry Integrate external tools [direct]
6. Actions Automate any workflow [direct]
7. Codespaces Instant dev environments [direct]
8. Issues Plan and track work [direct]
9. Code Review Manage code changes [direct]
10. Code Quality Enforce quality at merge [direct]
11. GitHub Advanced Security Find and fix vulnerabilities [direct]
12. Code security Secure your code as you build [direct]
13. Secret protection Stop leaks before they start [direct]
14. Why GitHub [direct]
15. Documentation [direct]
16. Blog [direct]
17. Changelog [direct]
18. Marketplace [direct]
19. View all features [direct]
20. Enterprises [direct]
21. Small and medium teams [direct]
22. Startups [direct]
23. Nonprofits [direct]
24. App Modernization [direct]
25. DevSecOps [direct]
26. DevOps [direct]
27. CI/CD [direct]
28. View all use cases [direct]
29. Healthcare [direct]
30. Financial services [direct]
31. Manufacturing [direct]
32. Government [direct]
33. View all industries [direct]
34. View all solutions [direct]
35. AI [direct]
36. Software Development [direct]
37. DevOps [direct]
38. Security [direct]
39. View all topics [direct]
40. Customer stories [direct]
41. Events & webinars [direct]
42. Ebooks & reports [direct]
43. Business insights [direct]
44. GitHub Skills [direct]
45. Customer support [direct]
46. Community forum [direct]
47. Trust center [direct]
48. Partners [direct]
49. View all resources [direct]
50. GitHub Sponsors Fund open source developers [direct]
51. Security Lab [direct]
52. Maintainer Community [direct]
53. GitHub Stars [direct]
54. Archive Program [direct]
55. Topics [direct]
56. Trending [direct]
57. Collections [direct]
58. Copilot for Business Enterprise-grade AI features [direct]
59. Premium Support Enterprise-grade 24/7 support [direct]
60. Pricing [direct]
61. Sign up [direct]
62. dfirdetective [direct]
63. Notifications [direct]
64. Issues 0 [direct]
65. Pull requests 0 [direct]
66. Actions [direct]
67. Projects [direct]
68. Security and quality 0 [direct]
69. Insights [direct]
70. Branches [direct]
71. Tags [direct]
72. 17 Commits [direct]
73. AppCacheParse.py [direct]
74. LICENSE [direct]
75. README.md [direct]
76. Activity [direct]
77. 5 forks [direct]
78. Report repository [direct]
79. Terms [direct]
80. Privacy [direct]