Blog

A fair comparison of Windows Timeline parsers: WxTCmd, kacos2000's tools, Plaso, Velociraptor, SQL queries and this browser parser, including WAL handling.

Windows Timeline, SRUM, Prefetch and Jump Lists compared: what each records, where it lives, how long it lasts and which question each one answers best.

Where Windows Timeline evidence runs out: expiry, settings, cleared history, deleted rows, WAL gaps and parser limits, plus how to detect deliberate tampering.

A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file.

How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding.

What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.

Step-by-step: open ActivitiesCache.db and its -wal in a free browser-based viewer, filter apps, files, focus time and clipboard, and export CSV or JSON.

Windows 11 retired the Timeline view, but ActivitiesCache.db can still be on disk. What changed, what sources say, and how to check a Windows 11 image yourself.

How SQLite write-ahead logging hides the newest Windows Timeline activity in ActivitiesCache.db-wal, how checkpoints work, and how to parse the WAL safely.