A forensic insight into Windows 10 Cortana search. Issue 66 (May 2017)

• Record Type: Journal Article
• Authors: Singh, Bhupendra; Singh, Upasna
• Is Part Of: Computers & security. Issue 66(2017)
• Page Start: 142
• Page End: 154
• Publication Date: 2017-05
• Subjects: Cortana forensics -- Windows 10 -- Windows forensics -- ESE database -- Microsoft Edge forensics; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.01.007
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: This study provides in-depth understanding of the artifacts and their location created by Cortana application. For decoding and exporting Cortana data, four custom python scripts have been developed to aid forensic investigations. A GUI tool has been introduced to extract and list Cortana web searches. The forensic usefulness of Cortana artifacts is demonstrated in terms of a timeline constructed over a period of time. Abstract: Cortana, one of the new features introduced by Microsoft in Windows 10 desktop operating systems, is a voice activated personal digital assistant that can be used for searching stuff on device or web, setting up reminders, tracking users' upcoming flights, getting news tailored to users' interests, sending text and emails, and more. Being the platform relatively new, the forensic examination of Cortana has been largely unexplored in the literature. This paper seeks to determine the data remnants of Cortana usage in a Windows 10 personal computer (PC). The research contributes in-depth understanding of the location of evidentiary artifacts on hard disk and the type of information recorded in these artifacts as a result of user activities on Cortana. For decoding and exporting data from one of the databases created by Cortana application, four custom python scripts have been developed. Additionally, as a part of this paper, a GUI tool called CortanaDigger is developed for extracting and listing web search strings, as well as timestamp of search made by a user on Cortana box. Several experiments are conducted to track reminders (based on time, place, and person) and detect anti-forensic attempts like evidence modification and evidence destruction carried out on Cortana artifacts. Finally, forensic usefulness of Cortana artifacts is demonstrated in terms of a Cortana web search timeline constructed over a period of time.