How to do it...

You will need a SQLite browser to access the database.

  1. Once you have started up your SQLite browser and accessed the database, you will be able to see a table of values which will include useful items such as Contact Permissions and Locations.
  2. You can work with this database directly in your SQLite browser, or you can export it to a CSV document which can then be opened with Microsoft Excel, Google Sheets or another program of your choice.
  1. It is worth noting that some of the data in the CortanaCoreDb.dat file may be obscured. Depending on what you are looking for, once you have opened the file to ensure it contains some data, you may wish to run it through a more sophisticated forensic program to uncover the data.
  2. The Reminders section of CortanaCoreDb.dat is concerned with calendar reminders, which can be a useful way to demonstrate a users intentions. For example, they may have set a reminder to tell them to go to a given location at a set time, which may place them near a crime scene. If this is then teamed up with actual location data from the CortanaCoreDb.dat LocationTriggers section, it can be either damning or absolving evidence.

It is a good idea to go thoroughly through all the items in the Cortana folder at the path mentioned above. The most relevant data is likely to be contained in CortanaCoreDb.dat, however there are certain items - such as geolocation searches and some dictation records - that may be found in other parts of the folder. As always with forensic examination, it is worth digging through the evidence with a fine-toothed comb, at least insofar as time allows.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.141.41.187