> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/data-analysis/forensics-data-analysis-application-specific.md).

# Application Specific

## Analyze Keepass Entry History

Keepass entries can store historical versions of data. If you have access to a decrypted Keepass database, check the history of interesting entries.

Open the decrypted Keepass database in the Keepass GUI. Select the entry you want to investigate. The entry dialog is shown when you create a new entry, edit an existing entry, or view an existing entry. Right-click or double-click the entry to View/Edit it. This dialog consists of several tabs. Look for a 'History' tab or option within the entry details window. This tab shows the history of the entry (previous versions). This tab will show previous versions of the entry, which might contain sensitive information no longer present in the current version. To view the details of a previous version, double-click it. If you want to restore a previous version, select it in the list and click 'Restore'. If you want to delete a previous version, select it and click 'Delete'.