ActivitiesCache.db Activity Types and Payload Fields
Field reference for ActivitiesCache.db: ActivityType values 5, 6, 10 and 16, the AppId JSON, payload keys like activeDurationSeconds and every timestamp column.
TL;DR. In Activity, the ActivityType column tells you how to read the row: 5 = opened (app, file, page), 6 = in focus with activeDurationSeconds, 10 = clipboard text in ClipboardPayload (Base64), 16 = copy/paste event with Group = Copy or Paste, 2 = notification. The app is in the AppId JSON array; the details are in the Payload JSON. Times are Unix seconds, UTC.
This is the field reference for the series. If you need to know what a row proves, read does Windows Timeline prove execution or file access? after this one.
Activity types
The activity type is an integer. The meanings below are observations from researchers, not a Microsoft specification: treat values not listed as unknown.
| ActivityType | Meaning | Source | What to read |
|---|---|---|---|
| 2 | Notification (toast) | kacos2000 | Payload |
| 3 | System use (backup, sign-in related) | kacos2000 repository | Payload |
| 5 | Open application, file or page | kacos2000 | displayText, appDisplayName, contentUri |
| 6 | Application in use / in focus | kacos2000 | activeDurationSeconds, userTimezone, StartTime, EndTime |
| 10 | Clipboard content | kacos2000, inversecos | ClipboardPayload (Base64) |
| 11, 12, 15 | System operations (credentials, Wi-Fi, personalisation) | kacos2000 repository | Payload |
| 16 | Copy or paste operation | kacos2000 | Group (Copy / Paste), clipboardDataId in Payload |
The Windows Timeline Parser maps 5 to "Opened", 6 to "In use (focus)", 10 to "Clipboard", 16 to "Copy / paste", 2 to "Notification", and everything else to "Other" with the raw number kept in the detail view.
The Activity table, column by column
| Column | Content | Notes |
|---|---|---|
Id | GUID of the activity | Links to Activity_PackageId.ActivityId and ActivityOperation.Id |
AppId | JSON array identifying the app | See below |
AppActivityId | App-specific identifier | For opened files it often ends with a per-file identifier (kacos2000) |
ActivityType | Integer type | Table above |
ActivityStatus | 1 active, 2 updated, 3 deleted, (4 ignored) | Mirrors the Graph status values (Microsoft Graph) |
Payload | JSON (stored as a BLOB) | Display text, URIs, durations, time zone |
ClipboardPayload | JSON array with Base64 content | Types 10 (content) |
StartTime, EndTime | Unix seconds, UTC | EndTime can be empty or 0 for point-in-time activities |
LastModifiedTime, LastModifiedOnClient | Unix seconds, UTC | Last change to the row |
ExpirationTime | Unix seconds, UTC | 30 days after last modification; 12 hours for clipboard (kacos2000) |
CreatedInCloud | Unix seconds, UTC | Relevant only for activity that was synced |
PlatformDeviceId | Device identifier | Distinguishes local from synced devices |
IsLocalOnly | 0 / 1 | Whether the activity is kept off the cloud |
Group, Tag | Free text | Group = Copy / Paste for type 16 |
ETag | Integer | Changes when the row changes; sorting by it gives write order, not event order |
kacos2000 notes that all dates are stored in UTC and that the ExpirationTime was exactly 2,592,000 seconds (30 days) after LastModifiedTime in the databases examined (kacos2000).
AppId: which application
AppId is a JSON array of { "application": ..., "platform": ... } objects. One activity can list the same app several ways (AppId JSON):
[
{"application": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\notepad.exe", "platform": "windows_win32"},
{"application": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\notepad.exe", "platform": "packageId"},
{"application": "", "platform": "alternateId"}
]
| Platform value | Typical content |
|---|---|
windows_win32 | Desktop app path, often starting with a known folder GUID |
x_exe_path | Stand-alone executable called from a specific path |
windows_universal | Store / UWP app identity (for example Microsoft.Windows.Explorer) |
packageId | Package name or executable path |
alternateId | Often empty |
The GUID prefix is a KNOWNFOLDERID (known folder GUID). The ones you will see most:
| GUID | Folder |
|---|---|
{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7} | %SystemRoot%\System32 (FOLDERID_System) |
{6D809377-6AF0-444B-8957-A3773F02200E} | Program Files, 64-bit (FOLDERID_ProgramFilesX64) |
{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E} | Program Files (x86) (FOLDERID_ProgramFilesX86) |
{905E63B6-C1BF-494E-B29C-65B732D3D21A} | Program Files (FOLDERID_ProgramFiles) |
{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27} | %SystemRoot%\SysWOW64 (FOLDERID_SystemX86) |
{F38BF404-1D43-42F2-9305-67DE0B28FC23} | %SystemRoot% (FOLDERID_Windows) |
The known folder GUID does not record the drive letter, so the tool renders it as an environment variable (%ProgramFiles%\7-Zip\7zFM.exe) rather than guess C:. An x_exe_path with a literal path such as C:\Users\Public\rclone.exe is worth a second look: it is an executable run from outside the usual install locations.
Payload: the details
The Payload column is JSON. Keys vary by activity type and app. The ones that matter for investigation:
| Key | Types | Meaning |
|---|---|---|
displayText | 5 | What the Timeline tile showed: file name, page title |
appDisplayName | 5 | Friendly app name ("Notepad", "Excel") |
description | 5 | Often the full file path |
contentUri | 5 | file:/// URI of the opened item; may carry extra query parameters |
activationUri | 5 | How Windows would relaunch the activity |
activeDurationSeconds | 6 | Seconds the app was in use (active duration) |
userTimezone | 6 | IANA/Olson time zone of the device when the activity was created (Microsoft Graph) |
clipboardDataId | 16 | Links copy and paste events of the same clipboard item (kacos2000) |
Two warnings from kacos2000's testing: the first execution entry of a desktop app may carry no duration at all, and the payload duration sometimes differs from EndTime - StartTime (kacos2000). Report the field you used.
The tool converts contentUri into a Windows path (file:///E:/exfil/Payroll_2026.xlsx?... becomes E:\exfil\Payroll_2026.xlsx, file://server/share/x becomes \\server\share\x), falls back to description when it looks like a path, and keeps the raw URI and the full payload JSON in the detail panel.
ActivityOperation and Activity_PackageId
ActivityOperation has most of the same columns plus OperationType (1 insert, 2 update, 3 delete) and CreatedTime, the moment the operation was queued. kacos2000 found that when a user removes a tile from Timeline, the entry is copied into ActivityOperation with a new ETag and a deleted status (kacos2000). That is why the ActivityOperation table is where you look for history the user tried to clean.
Activity_PackageId lists, per ActivityId, a Platform and PackageName (often the executable path) and an ExpirationTime. The tool attaches these package names to each activity.
Time: what to convert and how
Every time column is Unix epoch seconds in UTC. Convert with an explicit UTC formatter (datetime(StartTime, 'unixepoch') in SQLite), and use userTimezone only to express the local time the user saw. In the tool, the UTC / Local toggle changes display only; CSV exports carry UTC columns (StartTimeUtc, EndTimeUtc, ...).
FAQ
What is ActivityType 5 in ActivitiesCache.db?
Type 5 records an application, file or web page being opened. The payload carries the display text, the app display name and, for files, a contentUri with the path.
What is ActivityType 6?
Type 6 records an application in use, with focus. The payload holds activeDurationSeconds and the user's time zone, and the row has a start and end time.
What time format does ActivitiesCache.db use?
Unix epoch seconds in UTC for StartTime, EndTime, LastModifiedTime, ExpirationTime and the other time columns.