Skip to content
Timelineparser

ActivitiesCache.db-wal

Windows Timeline Parser

Apps a user ran, files they opened, how long each window had focus, and clipboard history — from ActivitiesCache.db and its -wal file. Parsed in your browser with WebAssembly — nothing is uploaded.

Drop ActivitiesCache.db and ActivitiesCache.db-wal here

Always add the -wal file: the most recent activity usually lives only there. Folders and ZIP triage collections (KAPE, Velociraptor) work as-is — every user's database is paired with its WAL.

A synthetic database from a fictional intrusion — no real data.

100% client-side: databases are parsed by WebAssembly in your browser and never uploaded.

How to get your data

Full acquisition guide

Collect ActivitiesCache.db together with its ActivitiesCache.db-wal from every account folder, then drop the result here. On a live Windows 10 machine this takes about two minutes.

  1. Collect the database and its -wal
  2. Drop the folder or ZIP here
  3. Parsed in your browser, never uploaded

Paste into Windows PowerShell run as administrator (system drive C:). It creates one shadow copy so the database and its WAL come from the same instant, copies both files for every profile, then removes the snapshot.

PowerShell · Admin
New-Item -ItemType Directory -Force -Path C:\triage | Out-Null
$sc = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{ Volume = 'C:\' }
$vss = Get-CimInstance -ClassName Win32_ShadowCopy -Filter "ID='$($sc.ShadowID)'"
cmd /c mklink /d C:\triage\vss "$($vss.DeviceObject)\"
robocopy C:\triage\vss\Users C:\triage\Users ActivitiesCache.db ActivitiesCache.db-wal /S /XJ /B /R:0 /W:0 /NP /NDL
cmd /c rmdir C:\triage\vss
$vss | Remove-CimInstance

Result: C:\triage\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<account-folder>\ with ActivitiesCache.db and ActivitiesCache.db-wal. Drop the C:\triage\Users folder here (drag it, or use Choose a folder).

Analysing on another machine? Pack it into one ZIP with the tar.exe built into Windows 10 1803 and later (a ZIP made with PowerShell's Compress-Archive works too):

PowerShell / cmd
tar -a -c -f C:\triage\timeline.zip -C C:\triage Users

Gotchas

  • A plain copy while the user is logged on fails or produces a file full of zeros (listed as "starts with zeros"). Use the shadow-copy command, KAPE or Velociraptor.
  • Take the database and its -wal at the same moment: without the WAL the latest activity is missing, and a WAL from another moment is ignored.
  • Entries expire after about 30 days and times are stored in UTC: collect early and note the user's time zone.

What is Windows Timeline?

Windows 10 (1803) introduced Timeline: a per-user history of the apps used, the documents and web pages opened, and how long each app had focus. Windows 11 retired the Timeline view; ActivitiesCache.db can still be found on Windows 11 systems (often carried over from Windows 10), but it is no longer actively maintained there, so don't expect recent activity.

Because it records files opened with their full paths, active time per app and — when clipboard history is enabled — copied text, it is one of the richest sources of user activity on Windows.

Where it is stored

  • C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db — <id> is L.<user> for local accounts, or an identifier for Microsoft / Entra accounts.
  • It is a SQLite database in WAL mode: ActivitiesCache.db-wal holds the latest changes until Windows checkpoints them. Copy both (and ignore -shm).
  • Tables: Activity (the timeline), ActivityOperation (pending sync operations, including deletions), Activity_PackageId (package names per activity).

Why it matters in an investigation

  • Files and folders opened, with full paths — including on USB drives and network shares.
  • Focus time per application (activity type 6): how long a tool was actually used, not just launched.
  • Clipboard content (activity type 10) when clipboard history or sync is enabled — commands, paths, credentials. Type 16 records copy and paste events, without the text.
  • ActivityOperation keeps pending operations, including deletions of activities the user removed from history.

Limitations

  • Entries expire (about 30 days by default) and depend on privacy settings ("Store my activity history").
  • Times are Unix seconds (UTC); the payload's userTimezone tells you the user's local zone.
  • Without the -wal file, the most recent activity is often missing.
  • Deleted records in free SQLite pages are not recovered yet.

How to get the files

  • Collect the whole ConnectedDevicesPlatform folder with KAPE (WindowsTimeline target), Velociraptor or from a disk image.
  • On a live system, copy ActivitiesCache.db and ActivitiesCache.db-wal at the same time: a WAL from another moment or database will not match (the tool detects and ignores a mismatched WAL).
  • Keep the Users\<name>\ folder structure so each database is attributed to its account.

FAQ

Is my database uploaded anywhere?

No. The parser — including its SQLite reader — is Rust compiled to WebAssembly and runs in a Web Worker in your browser. There is no upload endpoint.

Why is the -wal file so important?

ActivitiesCache.db runs in write-ahead-log mode: new and changed rows go to the -wal file first. On a live or recently used system the last hours of activity are often only there. This tool applies committed WAL transactions and marks every row that exists only in the WAL or changed there.

Does Windows 11 still have Timeline?

The Timeline view was retired. An ActivitiesCache.db can still exist on Windows 11 machines, often carried over from a Windows 10 upgrade, but it is no longer actively maintained, so it mostly holds older activity. Always check for it, and date what you find.

Can it recover the clipboard?

Yes, when the database holds clipboard activities (type 10, created with clipboard history or cross-device sync): their base64 content is decoded and shown as text. Type 16 entries record the copy or paste action itself, without the content.

How is this different from WxTCmd?

It covers the same tables and fields (and exports CSV), but runs in the browser with no install, applies the WAL itself, and flags WAL-only rows, deletions and clipboard items.

Blog

Read the blog
ActivitiesCache.db Parsers Compared: WxTCmd and More
A fair comparison of Windows Timeline parsers: WxTCmd, kacos2000's tools, Plaso, Velociraptor, SQL queries and this browser parser, including WAL handling.
windows-timelineactivitiescachetoolscomparison
Windows Timeline vs SRUM vs Prefetch vs Jump Lists
Windows Timeline, SRUM, Prefetch and Jump Lists compared: what each records, where it lives, how long it lasts and which question each one answers best.
windows-timelinecomparisonprogram-executiondfir
Windows Timeline Limitations and Anti-Forensics
Where Windows Timeline evidence runs out: expiry, settings, cleared history, deleted rows, WAL gaps and parser limits, plus how to detect deliberate tampering.
windows-timelineactivitiescacheanti-forensicssqlite