In other blog post, we discussed the updated Elcomsoft Phone Breaker that allows extracting search and browsing history, location data and call logs from users’ Microsoft Accounts. Now let’s talk about the origins of this data and how to enable its collection on different devices – even if they don’t run Microsoft Windows.

Location History

Location history is collected if you are using certain Microsoft services. Microsoft may collects location history from the following sources:

• Windows 10 desktops, laptops, 2-in-1 devices and tablets
• Windows Phone 8 and 8.1
• Windows 10 Mobile smartphones
• Using Bing in any Web browser running on any device (including Android, iOS, macOS, Linux etc.) if the following conditions are met:
  • The user has signed in to their Microsoft Account in the Web browser, and
  • The user enabled Location in general; for the Web browser; and for the Bing Web site
• Cortana personal assistant running on any supported device (Windows 10, Android, iOS)

Access to location is available in device settings. By default, location data will be shared with Microsoft.

Browsing History

Microsoft collects Web browsing history if you’re using Edge as your Web browser, and if you are signed in to Microsoft Account in the browser. Since Microsoft Edge is exclusive to Windows 10 (desktop and Mobile), browsing history is not collected from any other device.

In order to enable collection of Web browsing history, users must sign in to their Microsoft Account in the Edge browser. In addition, syncing must be enabled in the Settings. More information in this article:

https://www.windowscentral.com/sync-edge-between-windows-10-devices#sync

Search History

Microsoft stores search requests made on Bing.com regardless of the Web browser. Note that Bing search requests are only recorded if the user has been logged in to their Microsoft Account in the Web browser while running the search.

Since Cortana uses Bing by default, Cortana search queries are also recorded and stored in the cloud.

Search history can be synced across devices if the corresponding setting is enabled.

Call Logs

There is no specific setting to enable or disable call history. Call logs are not (yet) automatically synced via OneDrive or Microsoft Account. Instead, they become part of mobile backups produced by Windows 10 Mobile (and Windows Phone 8.x) smartphones. These backups are then stored in OneDrive. Elcomsoft Phone Breaker extracts information about the call logs from these mobile backups.

Backups are enabled by default in Windows Phone 8.x and Windows 10 Mobile devices. In order to enable or disable backups, visit Settings > Backup.

Text Messages (SMS)

Unlike call history, text messages are synchronized across devices. The relevant setting is accessible through the Messaging app itself and not the main Settings icon. To enable or disable SMS sync, users would go to Messaging > Settings > Sync as shown on the screen shot below. Once enabled, messages will be synced across all devices registered with the same Microsoft Account.