🖥️
Windows DFIR
  • Introduction
  • Windows Artifacts
    • Windows Quick Tips
      • Windows Command Line
      • Workstation File/Folder Locations
      • Server File/Folder Locations
    • Account Usage
      • Authentications SAM Artifacts
        • Last Login
        • Last Failed Login
        • Last Password Change
      • Authentications (Windows Event Log)
        • Logon ID
      • Group Membership
        • Event ID: 4798
        • Event ID: 4799
      • RDP
        • Source System Artifacts - Quick Reference
        • Destination System Artifacts - Quick Reference
      • SSH
      • Rouge Local Accounts
      • CrowdStrike Searches
        • Event Name - UserLogon
        • Event Name - UserLogonFailed
        • Event Name - UserLogonFailed2
        • Event Name - SsoApplicationAccess
    • Browser Usage
      • History & Downloads
        • Viewing History Files - DB Browser
        • Transition Types
      • Auto-Complete Data
      • Bookmarks
      • Browser Preferences
      • Cache
      • Cookies
      • Extensions
      • Super Cookies (HTML5 Web Storage)
      • Media History
      • Private Browsing
      • Session Restore
      • Stored Credentials
      • Suggested/Frequent Sites
      • DB Browser Queries
        • Firefox
        • Chrome
        • Media History
      • PowerShell Scripts
        • Browser Extension Finder
        • Browser History Finder
    • Processes
      • at.exe
      • explorer.exe
      • lsass.exe
      • lsaiso.exe
      • PuTTy.exe
        • X11 Forwarding
      • runtimebroker.exe
      • services.exe
      • smss.exe
      • System
      • svchost.exe
        • Services
      • winlogon.exe
      • wininit.exe
    • Cloud Storage
    • Deleted File or File Knowledge
      • WordWheelQuery (Win 7+)
      • ACMRU (Win XP)
      • Internet Explorer file:///
      • Last Visited MRU
      • Thumbs.db (Win XP)
      • Thumbcache
      • Recycle Bin
      • User Typed Paths
      • Windows Search Database
    • File Download
      • Zone.Identifer
      • Open/Save Most Recently Used (MRU)
      • Email
      • Drive By Downloads
        • Malvertising
      • Web Browsing
        • Cache Files
      • CrowdStrike Searches
        • MoTW
    • Folder/File Opening/Creation
      • Recent Files
      • Office Recent Files
      • Shell Bags
      • .lnk Files
      • Jump Lists
        • AppIDs
      • Prefetch
      • Index.dat file://
      • PowerShell Scripts
        • .lnk Files
    • Persistence
      • Registry
        • NTUSER.DAT & HKU\SID
        • Run and Run Once
        • Shell Folders and UserInit Key
        • Services
        • Logon Scripts
        • Office Add-ins
        • Winlogon Shell
        • Image File Execution Options (IFEO)
        • AppInit_DLLs
        • Scheduled Tasks
      • Scheduled Tasks
        • Scheduled Task Destination System Artifacts
        • Scheduled Task Source System Artifacts
      • Startup
      • Tool: AutoRuns
      • Accounts
      • WMI Event Consumers
        • WMI: Source System Artifacts
        • WMI: Destination System Artifacts
        • WMI: PowerShell Analysis
      • PowerShell Scripts
        • Startup Programs
      • CrowdStrike Searches
        • Files Written to Startup Folder
        • Files Written to Startup Folder from the Internet
        • Local Account Creation/Deletion
        • Azure Account Creation/Deletion
        • Scheduled Tasks
    • Physical Location
      • Time zone
      • Wireless SSID
      • Network History (Vista/Win7–11)
      • Cookies
      • Browser Search Terms
    • Program Execution
      • Prefetch
        • Decoding Prefetch Files with Eric Zimmerman's PECmd Tool
      • BAM/DAM
      • CapabilityAccessManager
      • UserAssist
      • Last Visited MRU
      • RunMRU
      • MUI Cache
      • ShimCache
      • Amcache
      • Jump Lists
    • Shadow Copies
      • VSC Permissions
      • Event ID 8193: Volume Shadow Copy Service Error
    • USB Usage
      • Key Identification
      • Drive Letter and Volume Name
      • Connection Timestamps
      • User
      • Volume Name
      • Plug & Play Event Log
    • Windows Services
      • DoSvc (Delivery Optimization)
    • System Information
    • Event IDs
      • Authentication / Account
        • 4624 - Authentication Success
          • Logon Types
        • 4625 - Authentication Failure
          • SubStatus Codes
        • 4634 - Account Logoff
        • 4648 - Explicit Credentials Success
        • 4672 - Special Privileges
        • 4720 - Account Creation
        • 4722 - Account Enabled
        • 4732 - Addition to Local Group
        • 4738 - Account Changed
        • 4776 - Kerberos Authentication Attempt
          • Substatus Codes
        • 4771 - Kerberos Failure
        • 4768
      • File System
        • 1006
        • 4688 - Process Created
        • 4663
        • 4656
        • 6416
        • 20001
        • 20003
  • Windows DFIR & MITTR
    • Initial Access
      • Content Injection
      • Drive-by Compromise
        • Watering Hole Attack
        • Microsoft Files (Payload Execution)
        • Exploit Delivery
        • Viewing Browser History Files
      • Phishing
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
      • Logon ID
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
  • SOC Related
    • Cached Credentials
    • Domain Controller Password Spraying
Powered by GitBook
On this page
  • List All Media Playback Sessions
  • Find Media Playback from Specific Origin
  • Aggregate Watch Time by Origin
  • Identify Most Frequently Played Media
  • Media Playback Within a Specific Timeframe

Was this helpful?

  1. Windows Artifacts
  2. Browser Usage
  3. DB Browser Queries

Media History

List All Media Playback Sessions

This query retrieves all records of media playback, including the media URL, start time, and duration.

SELECT 
    playback.url AS 'Media URL',
    datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time',
    playback.watch_time_s AS 'Duration (Seconds)',
    origin.origin AS 'Origin URL'
FROM playback
JOIN origin ON playback.origin_id = origin.id
ORDER BY playback.last_play_time DESC;

Find Media Playback from Specific Origin

If you're interested in media playback from a specific website, this query filters sessions by origin.

SELECT 
    playback.url AS 'Media URL',
    datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time',
    playback.watch_time_s AS 'Duration (Seconds)'
FROM playback
JOIN origin ON playback.origin_id = origin.id
WHERE origin.origin LIKE '%example.com%'
ORDER BY playback.last_play_time DESC;

Replace %example.com% with the desired website origin.

Aggregate Watch Time by Origin

To understand which websites users spend the most time watching media on, use this query to sum watch times grouped by origin.

SELECT 
    origin.origin AS 'Origin URL',
    SUM(playback.watch_time_s) / 60 AS 'Total Watch Time (Minutes)'
FROM playback
JOIN origin ON playback.origin_id = origin.id
GROUP BY origin.origin
ORDER BY SUM(playback.watch_time_s) DESC;

Identify Most Frequently Played Media

This query helps identify the most frequently accessed media files, which can be indicative of user interest or important content.

SELECT 
    playback.url AS 'Media URL',
    COUNT(playback.url) AS 'Play Count',
    SUM(playback.watch_time_s) / 60 AS 'Total Watch Time (Minutes)'
FROM playback
GROUP BY playback.url
ORDER BY COUNT(playback.url) DESC, SUM(playback.watch_time_s) DESC;

Media Playback Within a Specific Timeframe

To filter media playback sessions within a specific timeframe, modify this query with your desired dates.

SELECT 
    playback.url AS 'Media URL',
    datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time',
    playback.watch_time_s AS 'Duration (Seconds)'
FROM playback
WHERE playback.last_play_time BETWEEN strftime('%s','2024-01-01')*1000000+11644473600000000
                                AND strftime('%s','2024-01-31')*1000000+11644473600000000
ORDER BY playback.last_play_time DESC;

Adjust the dates in the BETWEEN clause ('2024-01-01' and '2024-01-31') to the desired timeframe.

PreviousChromeNextPowerShell Scripts

Last updated 1 year ago

Was this helpful?