Edge / IE WebCacheV01.dat

Legacy Edge and Internet Explorer store browsing history, cached content, cookies, and download records in a single Extensible Storage Engine (ESE) database — WebCacheV01.dat. This monolithic artifact survives browser history clearing, contains URL access timestamps with second-level precision, and records web activity from Windows system components that use WinINet/WinHTTP.

What Is WebCacheV01.dat?

WebCacheV01.dat is an ESE database used by Internet Explorer 10+, Legacy Edge (EdgeHTML), and Windows system components to store web cache metadata, browsing history, cookies, and download records. It uses the same database engine as Active Directory (ntds.dit), SRUM (SRUM.db), and Exchange Server. The database is locked by taskhostw.exe on a live system.

Unlike modern Chromium-based Edge (which uses Chrome-style SQLite databases), the legacy web cache stores everything in a single ESE database with multiple container tables. Each container has a ContainerId mapping to a specific data type. The database also stores cache entries for Windows components that use WinINet or WinHTTP: Windows Update, Office activation, Cortana, and Store apps all write entries, making it a surprisingly broad artifact.

Location & Format

Container Structure

What It Reveals

• Complete IE/Legacy Edge browsing history — URLs, access counts, and timestamps for every page visited.
• Cached content metadata — What files were cached, their sizes, and last access times.
• Cookie data — Domain, name, and sometimes value of cookies set by visited sites.
• Download records — URLs of downloaded files with destination paths and timestamps.
• System-level web requests — Windows Update, Office, Store, Cortana network activity.
• InPrivate remnants — Some entries persist after InPrivate sessions in certain IE versions.
• Cleared history data — ESE free pages may retain deleted records.
• Typed URLs — The Visited: prefix distinguishes typed from clicked navigation.

Forensic Use Cases

1. Corporate Policy Violation

An employee uses IE to access personal webmail to exfiltrate documents as attachments. WebCacheV01.dat records every visit to the webmail domain with exact timestamps. The iedownload container may show files downloaded from the corporate intranet immediately before the webmail visits.

2. Malware Delivery Reconstruction

A drive-by download attack delivered malware through a compromised website. WebCacheV01.dat preserves the full URL chain: the initial page, the injected iframe, the exploit kit landing page, and the payload download URL, each with an independent timestamp.

3. Legacy System Investigation

Many enterprise environments still run IE11 for legacy intranet applications. WebCacheV01.dat is often the only browser artifact available on these systems, making it critical for investigations involving older infrastructure.

4. Windows Component Activity

Beyond browser usage, WebCacheV01.dat reveals when Windows Update checked for patches, when Office made activation calls, and when Store apps were downloaded — establishing whether the system was patched at the time of compromise.

5. History Recovery After Clearing

The user clears browsing history through IE settings. The ESE database marks records as deleted but does not overwrite pages. ESE-aware recovery tools can extract deleted entries from free pages.

Acquisition Methods

:: Using KAPE
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target WebCache

:: Using VSS to bypass file lock
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\AppData\Local\Microsoft\Windows\WebCache\* C:\Evidence\WebCache\

:: Repair dirty database before parsing
esentutl /r V01 /d /l C:\Evidence\WebCache\ /s C:\Evidence\WebCache\

Parsing Tools & Analysis

Retention & Persistence

Version Differences

Anti-Forensics Resilience

MITRE ATT&CK Detection Mapping

Related Artifacts & Cross-References

References

1. NirSoft, “ESEDatabaseView” — nirsoft.net
2. Joachim Metz, “libesedb” — github.com/libyal/libesedb
3. SANS Institute, “IE and Edge Forensics” — sans.org
4. Obsidian Forensics, “Hindsight” — github.com
5. Microsoft, “ESE Database Engine” — learn.microsoft.com