The king is dead, long live the king! Windows 10 EOL and Windows 11 forensic artifacts

Windows 11 brings several new forensic artefacts and changes that security responders should note, with the piece emphasising Recall as a high-profile feature and the updated Windows Search structure.

Recall, introduced in May 2024, stores screenshots of a user’s activity and associated metadata in a local database, with full-screen captures saved under %AppData%\Local\CoreAIPlatform.00\UKP\{GUID}\ImageStore\ and Exif.Photo[.]MakerNote tags, and it can be enabled per user via registry keys; while a filter aims to exclude sensitive data, researchers warn the filter may not always engage reliably.

Notebooks and standard applications also generate new artefacts: Notepad now supports multi-tab mode, with TabState and WindowsState files detailing tab contents and window state, stored under %LOCALAPPDATA%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\.

Windows 11 also updates the Windows Search mechanism, moving from a single ESE database to three SQLite databases at %PROGRAMDATA%\Microsoft\Search\Data\Applications\Windows, including Windows-gather[.]db and its SystemIndex_Gthr and SystemIndex_GthrPth tables for reconstructing file paths. The piece also notes changes to PCA artefacts, and provides details on the new PCA log files in C:\Windows\appcompat\pca\, plus the Windows 11 support timeline, with Microsoft discontinuing support on 14 October 2025.

According to Securelist, these shifts, alongside NTFS attribute changes and extended search data, warrant incorporating these files into triage tools, as noted by Kirill Magaskin.