Update README.md · dfirdetective/WinSearchAppCache@5f08082 · GitHub

https://github.com/dfirdetective/WinSearchAppCache/commit/5f08082b827e5726e443f3787d7da055e3633ee8 • 292 KB fetched
Open original page

Update README.md · dfirdetective/WinSearchAppCache@5f08082 · GitHub

Skip to content

Navigation Menu

Sign in Appearance settings

* Platform
* AI CODE CREATION
* GitHub Copilot Write better code with AI

* GitHub Copilot app Direct agents from issue to merge

* MCP Registry Integrate external tools

* DEVELOPER WORKFLOWS
* Actions Automate any workflow

* Codespaces Instant dev environments

* Issues Plan and track work

* Code Review Manage code changes

* Code Quality Enforce quality at merge

* APPLICATION SECURITY
* GitHub Advanced Security Find and fix vulnerabilities

* Code security Secure your code as you build

* Secret protection Stop leaks before they start

* EXPLORE
* Why GitHub

* Documentation

* Blog

* Changelog

* Marketplace

View all features

* Solutions
* BY COMPANY SIZE
* Enterprises

* Small and medium teams

* Startups

* Nonprofits

* BY USE CASE
* App Modernization

* DevSecOps

* DevOps

* CI/CD

* View all use cases

* BY INDUSTRY
* Healthcare

* Financial services

* Manufacturing

* Government

* View all industries

View all solutions

* Resources
* EXPLORE BY TOPIC
* AI

* Software Development

* DevOps

* Security

* View all topics

* EXPLORE BY TYPE
* Customer stories

* Events & webinars

* Ebooks & reports

* Business insights

* GitHub Skills

* SUPPORT & SERVICES
* Documentation

* Customer support

* Community forum

* Trust center

* Partners

View all resources

* Open Source
* COMMUNITY
* GitHub Sponsors Fund open source developers

* PROGRAMS
* Security Lab

* Maintainer Community

* GitHub Stars

* Archive Program

* REPOSITORIES
* Topics

* Trending

* Collections

* Enterprise
* ENTERPRISE SOLUTIONS
* Enterprise platform AI-powered developer platform

* AVAILABLE ADD-ONS
* GitHub Advanced Security Enterprise-grade security features

* Copilot for Business Enterprise-grade AI features

* Premium Support Enterprise-grade 24/7 support

* Pricing
Search /

Sign in
Sign up Appearance settings

You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

dfirdetective

/

WinSearchAppCache

Public

*
Notifications
You must be signed in to change notification settings

*
Fork
5

*

Star
10

*

Code

*

Issues
0

*

Pull requests
0

*

Actions

*

Projects

*

Security and quality
0

*

Insights

Additional navigation options

*

Code

*

Issues

*

Pull requests

*

Actions

*

Projects

*

Security and quality

*

Insights

Commit 5f08082

Browse files Browse the repository at this point in the history Browse files

dfirdetective
authored

Update README.md
Added SettingsCache info and clarity.

1 parent f4f9000 commit 5f08082 Copy full SHA for 5f08082

1 file changed

+ 23 - 1 Lines changed: 23 additions & 1 deletion

File tree
Expand file tree Collapse file tree
Open diff view settings

Filter options

*

README.md

Expand file tree Collapse file tree
Open diff view settings

Collapse file
‎ README.md ‎
Copy file name to clipboard Expand all lines: README.md
+ 23 - 1 Lines changed: 23 additions & 1 deletion

* Display the source diff

* Display the rich diff

Original file line number Diff line number Diff line change
@@ -39,6 +39,28 @@ Additional Notes:

39 39 If ParsingName starts with ` 6D809377-6AF0-444B-8957-A3773F02200E ` or ` 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E ` that seems to refer to the folder ` C:\Program Files (x86)\ ` . Confirmed by both registry folder values ( ` HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions ` ) and looking at the full path of the executable. If it starts with ` 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7 ` or ` D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27 ` that seems to refer to System32 or SysWOW64. Last, if it starts with ` F38BF404-1D43-42F2-9305-67DE0B28FC23 ` , it is located in the ` C:\Windows ` folder.

40 40 It appears that ` Tile.Background ` has a common value of ` 16777215 ` on my machine for most applications and then some Windows applications have other larger values.

41 41

42 +

43 + ## Settings Cache

44 + Appears to be default data related to searches that would call Windows data, troubleshooters, and system settings. Not every row has entries in every column and the parser for this breaks at the same row every time I run it and I haven't had time to troubleshoot yet.

45 + * Parsed SettingsCache-output.csv will be * ** INCOMPLETE ** .

46 +

47 +

48 + Headers are:

49 + ParsingName, ActivationContext, SmallLogoPath, PageID, SettingID, HostID, Condition, Comment, and HighKeywords

50 +

51 + | Headers | Sample | Hypothesis |

52 + | --- | --- | --- |

53 + | ParsingName | ` Classic_{1498BF43-8A3E-4B9C-917B-C419E4501A62}.settingcontent-ms ` | File identifier |

54 + | ActivationContext | ` %windir%\system32\msdt.exe -id NetworkDiagnosticsInbound -ep CortanaSearch ` | What is offered/returned |

55 + | SmallLogoPath | ` %windir%\diagnostics\system\Networking\DiagPackage.dll,-20004 ` | Path to a logo |

56 + | PageID | ` C58C4893-3BE0-4B45-ABB5-A63E4B8C8651 ` | Registry - SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\ - Identifies as "Troubleshooting" |

57 + | SettingID | ` 1498BF43-8A3E-4B9C-917B-C419E4501A62 ` | Matches the ParsingName alphanumerics |

58 + | HostID | ` 12B1697E-D3A0-4DBC-B568-CCF64A3F934D ` | Only two unique values through the list |

59 + | Condition | ` shcond://v1#IsServer;1 ` | Windows Shell conditions cached? |

60 + | Comment | Find and fix problems with Windows Firewall | Default text that pops up in search when you search related keywords |

61 + | HighKeywords | windows firewall troubleshooter;troubleshoot windows firewall;troubleshoot firewall;network troubleshooter;troubleshoot network;fix firewall;fix network;network issues;network problems;firewall issues;firewall problems;incoming connections;inbound connections;troubleshooters | Keywords for Search optimizing? |

62 +

63 +

42 64 ## Script Info

43 65

44 - I will be continuing to work on this as time allows. It is intended only for my research purposes at this time. You can run it from any folder on a Windows machine and it * should * pull the ` AppCache#.txt ` file from the host machine and copy it to a folder within the working directory along with the csv of simply parsed data. The ` ConnectedSearch.Jumplists ` needs more parsing but I wanted a quick way to pull on different machines so I could just copy one folder over. I am running this on Python 3.10.4.

66 + I will be continuing to work on this as time allows. It is intended only for my research purposes at this time. You can run it from any folder on a Windows machine and it * should * pull the ` DeviceSearchCache ` folder contents from the host machine and copy it to a folder within the working directory along with the CSVs of simply parsed data. The ` ConnectedSearch.Jumplists ` needs more parsing but I wanted a quick way to pull on different machines so I could just copy one folder over. I am running this on Python 3.10.4.

0 commit comments
Comments
0  ( 0 )

Footer

(c) 2026 GitHub, Inc.

Footer navigation

*
Terms

*
Privacy

*
Security

*
Status

*
Community

*
Docs

*
Contact

*

Manage cookies

*

Do not share my personal information

You can’t perform that action at this time.

Links found on this page

1. Skip to content [direct]
2. Sign in [direct]
3. GitHub Copilot Write better code with AI [direct]
4. GitHub Copilot app Direct agents from issue to merge [direct]
5. MCP Registry Integrate external tools [direct]
6. Actions Automate any workflow [direct]
7. Codespaces Instant dev environments [direct]
8. Issues Plan and track work [direct]
9. Code Review Manage code changes [direct]
10. Code Quality Enforce quality at merge [direct]
11. GitHub Advanced Security Find and fix vulnerabilities [direct]
12. Code security Secure your code as you build [direct]
13. Secret protection Stop leaks before they start [direct]
14. Why GitHub [direct]
15. Documentation [direct]
16. Blog [direct]
17. Changelog [direct]
18. Marketplace [direct]
19. View all features [direct]
20. Enterprises [direct]
21. Small and medium teams [direct]
22. Startups [direct]
23. Nonprofits [direct]
24. App Modernization [direct]
25. DevSecOps [direct]
26. DevOps [direct]
27. CI/CD [direct]
28. View all use cases [direct]
29. Healthcare [direct]
30. Financial services [direct]
31. Manufacturing [direct]
32. Government [direct]
33. View all industries [direct]
34. View all solutions [direct]
35. AI [direct]
36. Software Development [direct]
37. DevOps [direct]
38. Security [direct]
39. View all topics [direct]
40. Customer stories [direct]
41. Events & webinars [direct]
42. Ebooks & reports [direct]
43. Business insights [direct]
44. GitHub Skills [direct]
45. Customer support [direct]
46. Community forum [direct]
47. Trust center [direct]
48. Partners [direct]
49. View all resources [direct]
50. GitHub Sponsors Fund open source developers [direct]
51. Security Lab [direct]
52. Maintainer Community [direct]
53. GitHub Stars [direct]
54. Archive Program [direct]
55. Topics [direct]
56. Trending [direct]
57. Collections [direct]
58. Copilot for Business Enterprise-grade AI features [direct]
59. Premium Support Enterprise-grade 24/7 support [direct]
60. Pricing [direct]
61. Sign up [direct]
62. dfirdetective [direct]
63. WinSearchAppCache [direct]
64. Notifications [direct]
65. Issues 0 [direct]
66. Pull requests 0 [direct]
67. Actions [direct]
68. Projects [direct]
69. Security and quality 0 [direct]
70. Insights [direct]
71. Browse files [direct]
72. dfirdetective [direct]
73. f4f9000 [direct]
74. Terms [direct]
75. Privacy [direct]
76. Security [direct]
77. Status [direct]
78. Community [direct]
79. Contact [direct]