Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Media forensics
Analyze images and videos stored in Windows Photo application
11.06.2024
OneNote password recovery v3.4
Support for Microsoft Office 365
17.04.2024
Reset Windows Password v14.2
Telegram data recovery, Photo Database and Media Player investigation tools, and some more
12.04.2024
Office password recovery tools
Resetting VBA passwords
01.03.2024
New blog post
Dumping the history of users' IP addresses in Windows

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: Windows media forensics


The Windows Media Forensics tool analyzes and displays in a human-readable format Windows photo and video artifacts stored by the Windows Photos application. The Windows Photo library provides a heap of information that could be handy for investigators in a digital forensic analysis.

The Windows Photos is available in Windows 10 and later OSes. The application's database resides at:
C:\Users\%user%\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite

Additional Photo, Video and Media databases can be found at the following locations:
C:\Users\%username%\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe
C:\Users\%username%\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe


You can use the program's Backup feature to save the data for future analysis.
 

Windows media forensics
 

The Windows Media Forensics tool consists of several parts:
  1. Image analysis
  2. Video analysis
  3. User actions
  4. Photo library (Windows Photos related information)
  5. Photo library activity
  6. Media Player library
  7. Media Player activity