Introducing AppsIndex.db: New Windows 11 Artifact for Tracking Start Menu Application Execution

This report analyzes the Windows 11 AppsIndex.db SQLite database, an artifact maintained by the Windows Feature Experience Pack that tracks per-user launch counts for Start Menu applications. It details database paths, relevant tables (tiles and tiles_content) and fields that store executable paths, display names, and execution counts, while noting key limitations such as no execution timestamps and rapid purging of entries when apps are unpinned or uninstalled (with potential recovery from freelist). The report compares run counts with UserAssist and Prefetch to explain expected discrepancies and warns that a privacy setting (“Improve Start and search results”) can disable launch count tracking, emphasizing the need to correlate this artifact with others for reliable execution evidence.