Windows 10 Maps Blog

Investigating Windows 10 Maps

29/11/2021 Monday

Windows 10 Maps is an online mapping client software, where the process is served using geographic information systems on the Internet. Windows 10 Maps was developed by Microsoft Corporation, and it is available for Windows 8/10, Xbox One system software, and Xbox Series X/S.

Digital Forensics Value of Windows 10 Maps Artifacts

Windows 10 Maps contain a valuable amount of information about a user’s activities since it stores the location and its related navigation history data for a user such as addresses, latitude longitude points, timestamps, searches and so much more that could be critical to digital forensics investigations.

Location of Windows 10 Maps Artifacts

Windows 10 Maps artifacts are stored in the following locations:

C:\Users\<Username>\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe
C:\Users\<Username>\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat.LOG1
C:\Users\<Username>\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\Collections\610bbaf8b3c63569\Collections.db

Structure of Windows 10 Maps Artifacts

This artifact consists of a database and a settings file, called Settings.dat. In the .dat file, some useful information about the user could be obtained such as the first name, last name, and username. For the database file, called Collections.db, it has four different tables DBCollection, DBItem, DirtyBit, and Etag. Most of the important data is obtained from DBCollection and DBItem tables.

Analyzing Windows 10 Maps Artifacts with ArtiFast Windows

This section discusses how to use ArtiFast Windows to analyze Windows 10 Maps artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifacts Selection phase, you can select Windows 10 Maps artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of Windows 10 Maps artifacts in ArtiFast Windows.

Windows 10 Maps Items Artifact

Created Date/Time - Date and time location item was created.
Accessed Date/Time - Date and time location item was accessed.
Modified Date/Time - Date and time location item was modified.
Item ID - Unique Item identifier.
Collection ID - Collection ID the item belongs to.
Entity ID - Unique entity ID.
Is Dirty - Whether the item was changed since the last time it was saved.
Is New - Is the item new.
Type - Type of the location item.
Original Name - Name of the location.
Is Business - Is the item a business location.
Phone Number - Phone number.
Single Line Address - Single line address of the location.
Latitude - Latitude of the location.
Longitude - Longitude of the location.
Postal Code - Postal code.
Region - Region.
Locality - Address locality.
Description - Address description.
Country - Address country.
Query String - Search query string.

Windows 10 Maps Collections Artifact

Created Date/Time - Date and time collection was created.
Accessed Date/Time - Date and time collection was accessed.
Modified Date/Time - Date and time collection was modified.
Collection ID - Collection ID the item belongs to.
Collection Name - Collection name.
Collection Type - Collection type.
Description - Description.
Items Count - Number of items in the collection.
Items - Items in the collection.
Is Dirty - Whether the item was changed since the last time it was saved.
Is New - Is the item new.

Windows 10 Maps User Information Artifact

Last Update Date/Time - Date and time key was last updated.
Account Id - User account Id.
UserName - Account username.
First Name - First name.
Last Name - Last name.