Introduction
Microsoft Edge is a web browser developed by microsoft.com and is the default browser on modern Windows operating systems.
Designed to replace the aging Internet Explorer browser, Microsoft Edge offers improved performance, enhanced security, greater standards compliance, and support for modern web technologies.
As one of the world’s most widely used browsers, Edge stores a significant amount of user data that can be valuable during digital forensic investigations.
Digital forensic examiners frequently analyse Microsoft Edge artefacts to reconstruct user activity, establish timelines, identify visited websites, recover downloads, and determine whether evidence relevant to an investigation exists on a device.
History of Microsoft Edge
Microsoft Edge was first introduced in July 2015 alongside the release of Windows 10. It was developed as a replacement for Internet Explorer, which had faced criticism for poor standards compliance, security vulnerabilities, and declining popularity.
The original version of Edge used Microsoft’s proprietary Edge HTML rendering engine. While it offered improved performance over Internet Explorer, it struggled to compete with browsers such as Google Chrome and Mozilla Firefox due to compatibility issues and a limited extension ecosystem.
In January 2020, Microsoft released a redesigned version of Edge built on the open-source Chromium engine, the same underlying technology used by Google Chrome. This transition significantly improved website compatibility, browser performance, and extension support while maintaining Microsoft’s security and enterprise management features.
Today, Microsoft Edge is available for Windows, macOS, Linux, Android, and iOS devices and is widely used in both personal and corporate environments.
Importance of Microsoft Edge in Digital Forensics
Web browsers often contain extensive records of user activity. Microsoft Edge stores information relating to:
- Browsing history
- Search queries
- Downloads
- Cookies
- Saved passwords
- Autofill information
- Website permissions
- Cached web content
- Session data
- Synchronised cloud activity
These artefacts can assist investigators in determining:
- Which websites were visited
- When websites were accessed
- What files were downloaded
- Whether a user logged into online services
- User intent and behaviour patterns
- Corroboration of other digital evidence
Microsoft Edge Forensic Artefacts
Browsing History
One of the most valuable forensic artefacts is browsing history.
Edge stores records of:
- URLs visited
- Page titles
- Visit counts
- Timestamps
- Referring websites
For Chromium-based Edge, browsing history is typically stored within the location [AppData]\Microsoft\Edge\User Data\Default\History
The History file is a SQLite database containing records of websites visited by the user.
Investigators can use this information to establish browsing timelines and identify user activity relevant to an investigation.
Download History
Microsoft Edge maintains records of downloaded files, including:
- File names
- Download URLs
- Download timestamps
- File paths
- Download status
Download information is also stored within the History SQLite database.
These records can help identify whether files of evidential value were obtained from the internet.
Cookies
Cookies are small files stored by websites to remember user preferences and sessions.
Edge cookies may contain:
- Login session identifiers
- User preferences
- Tracking information
- Website interaction data
Typical location %LocalAppData%\Microsoft\Edge\User Data\Default\Network\Cookies
Cookie analysis can help demonstrate that a user accessed specific online services.
Cache Files
Edge stores cached web content locally to improve browsing performance.
Cached artefacts may include:
- Images
- HTML files
- JavaScript files
- CSS files
- Media content
Typical location %LocalAppData%\Microsoft\Edge\User Data\Default\Cache
Even after a website is no longer accessible, cached files may provide evidence of prior viewing activity.
Saved Passwords
Users may choose to save passwords within Microsoft Edge.
Stored information can include:
- Website URLs
- Usernames
- Encrypted passwords
- Typical database:
- Plain text
- Login Data
located within %LocalAppData%\Microsoft\Edge\User Data\Default\
Access to saved credentials may assist investigators in identifying accounts associated with a device, subject to legal authority and forensic procedures.
Autofill Data
Edge can store information entered into web forms, including:
- Names
- Email addresses
- Telephone numbers
- Addresses
These records are stored within the Web Data SQLite database file.
Autofill artefacts can help identify device users and demonstrate interactions with websites.
Bookmarks
Bookmarks provide evidence of websites that a user intentionally saved for future access.
Typical location %LocalAppData%\Microsoft\Edge\User Data\Default\Bookmarks
The bookmark file is stored in JSON format and may contain:
- Website URLs
- Folder structures
- Creation timestamps
Session and Tab Recovery Data
Microsoft Edge stores information regarding open browser sessions.
Artefacts may reveal:
- Recently opened tabs
- Previously viewed websites
- Browser recovery sessions
Relevant files can be found within file named Sessions and Session Storage location.
These artefacts are particularly useful when examining devices that were powered on or recently shut down.
Search History
Search activity can often be reconstructed through:
- Browser history
- Search engine URLs
- Cached content
- Synchronised account activity
Search queries can provide valuable insight into a user’s intentions, interests, and actions immediately before an event.
Microsoft Account Synchronisation
Users signed into a Microsoft account may synchronise:
- Browsing history
- Passwords
- Bookmarks
- Open tabs
- Settings
Cloud synchronisation may create additional evidential opportunities where legally authorised access exists.
Common Microsoft Edge Artefact Locations
History – User Data\Default\History
Cookies – User Data\Default\Network\Cookies
Cache – User Data\Default\Cache
Passwords – User Data\Default\Login Data
Autofill – User Data\Default\Web Data
Bookmarks – User Data\Default\Bookmarks
Sessions – User Data\Default\Sessions
Extensions – User Data\Default\Extensions
Challenges for Investigators
Several factors can complicate Edge investigations:
- Private (InPrivate) browsing mode
- Browser data deletion
- Encryption of saved credentials
- Cloud synchronisation across multiple devices
- Anti-forensic techniques
- Automatic cache clearing
Despite these challenges, artefacts often remain recoverable through forensic acquisition techniques and analysis of associated system files.
Conclusion
Microsoft Edge has evolved from a replacement for Internet Explorer into a modern Chromium-based browser used by millions worldwide.
From a digital forensic perspective, Edge contains a wealth of evidential artefacts that can reveal browsing activity, downloads, searches, saved credentials, and user interactions with online services.
Examination of Edge artefacts is therefore a routine and valuable component of computer forensic investigations, helping investigators reconstruct events, establish timelines, and present reliable digital evidence in both civil and criminal proceedings.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
