I am investigating a case where I'm looking for browser history evidence. Based on proxy logs and analyzing the user agent string associated with a request, it looks like it came from an Edge browser client.
When viewing the WebCacheV01.dat DB in ESEDatabaseView and inspecting the Containers table I don't see any Edge artifacts in the normal locations such as AC\MicrosoftEdge, AC\#!001, AC\#!002, or AC\#!121.
I made a copy of the WebCacheV01.dat and other files in the directory and tried to recover the DB using esentutl but it failed and I got an error stating that the file was locked.
Any thoughts on why I don't see Edge artifacts in the DB or why I am unable to recover the file?