Eng Tha
Window 8 Search History Extractor
Introduction When you use the Window 8 search box to conduct searches, the system will automatically remember each search term.The search terms are stored both within a Windows event log called Microsoft-Windows-Connected-Search/Operational.evtx and as individual link (LNK) files.

Each link file holds a single previously searched for keyword (or phrase) and are found in the following location, C:\Users\USER\AppData\Local\Microsoft\Windows\ConnectedSearch\History.

Window 8 Search History Extractor will extract the search terms from both the event log and LNK files.

This utility is released as freeware. You are allowed to freely distribute this program via any method, as long as you don't charge anything for this. If you distribute this utility, you must include all files in the distribution package, without any modification!

Icons by Everaldo Coelho from the Crystal project are used; these are released under the LGPL license.

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.


If you have any feedback please email us at forensictools@orionforensics.com

Window 8 Search History Extractor v1.0.0
Orion Investigations Co Ltd
16th, 20th,25th Floor, Unit 1601,2001-2002,2501 BBC Building,
29 Sukhumvit 63 North Kong Tan, Wattana, Bangkok 10110 Thailand.
Tel : +66-2-7143801 to 3 Fax : +66 (0) 2 714 3804
Email : hi-tech@orioninv.co.th or forensics@orionforensics.com
A Member Of
Copyright © 2013 Orion Investigation Co., Ltd.