Windows 8 File History Analysis (Forensic Focus)

1. What is File History
File History is a new backup service introduced in Windows 8. By default this feature is off and to turn it on, user has to select a backup location – either a network drive or external storage media. Thus, it does not allow user to use the same disk. File History backs up files of the Libraries, Desktop, Contacts and Favorites folders. There is an option to exclude any folder(s) that users don’t want to backup. Notice that File History is unable to backup your folders synced with cloud storage service(s). According to Microsoft, “File History doesn’t back up files on your PC that you have synced with SkyDrive, even if they’re in folders that File History backs up.” Once turned on, File History automatically backs up the folders after every hour by default; however this interval can be changed easily in advanced settings. In addition, at any time, user can manually run the service. File History appears as fhsvc in the Task Manager and some associated dlls are fhcfg.dll, fhcpl.dll and fhsvcctl.dll.

Full Story