BITS on windows 10

[mgreen27]

Hello,

Nice tool. I notice the BITS/QMGR files are different on my Win10 machine. I was wondering if you have done any work or seen any research on parsing Windows 10 BITS?

Matt

[mc-anssi]

Hi Matt,
The format of QMGR files has changed with latest Windows 10.
MS has migrated from an undocumented format to an ESE database (as for lots of MS products, such as exchange, IE Webcache, etc).
Bits_parser parser works with the previous QMGR queue files.
There are a lots of tools and research to carve ESE databases.
Morgane