Hello,
Anyone know of a file that holds the bookmarks created in investigator? It'd be nice to be able to save it off to network drive incase of uninstalling the client or moving to different machine, maybe you could put it back into original location and all the bookmarks would carry over.
Thanks
OK since none of you are letting me be lazy by answering my question, I decided to fire up Sysinternals Process Monitor and then add a bookmark and see where the program was writing to. Turns out my idea will work as I just tested recovering bookmarks from one Win profile to another.
The file is %userprofile%\AppData\Roaming\NetWitness\NwInvestigator9.settings
In this XML-like file there is a cleartext section that is semi-colon separated that holds the bookmarks between open/close tags below. Just cut/paste them from one profile's file to another one and save it (you'll have to be local admin). Maybe one day the bookmark feature functionality will be expanded as it's pretty weak now, I have over 50 bookmarks and I can't even put them in folders, change to a friendly name, etc.
<Bookmarks>
</Bookmarks>
PS: I was able to recover bookmarks from this file even after uninstalling/reinstalling the NW client when bookmarks weren't showing up in Investigator anymore, not sure why that was and YMMV.