ActivitiesCache.db Parsers Compared: WxTCmd and More

TL;DR. WxTCmd is the reference: free, scriptable, three CSVs, KAPE-friendly. kacos2000's tools are the research toolkit, including clipboard carving. Plaso puts Timeline into a super-timeline. Velociraptor collects and queries at fleet scale. The Windows Timeline Parser is for no-install triage in a browser, with its own WAL replay and per-row WAL status. For anything that goes to court, run two of them and compare.

This comparison sticks to what each project documents or what its source shows. Where something is not documented, the table says so rather than guessing.

The contenders

Commercial suites also parse Timeline; Belkasoft, for example, has published a walkthrough on Forensic Focus. They are out of scope here.

WxTCmd

WxTCmd is the tool most analysts reach for, and for good reason. It takes a database with -f and an output directory with --csv, with an optional --dt date format (README). Its source writes three files, one each for Activity, ActivityOperation and Activity_PackageId, prefixed with a timestamp and the profile name taken from the path (Program.cs). The Activity CSV includes the executable, display text, content info, payload, clipboard payload, start, end, duration, time zone and device platform columns. SANS lists it among its forensic tools (SANS).

WAL handling. The README does not mention the WAL. The source opens the database through an ORM on top of a standard SQLite library, without copying it. By SQLite's design, a -wal file sitting next to the database is read, and the last connection to close may checkpoint it into the database and delete it (sqlite.org). Practical consequence: keep ActivitiesCache.db-wal next to the copy you parse, never point WxTCmd at original evidence, and expect the WAL on that copy to be consumed.

Strengths: mature, scriptable, a ready KAPE module, CSVs ready for Timeline Explorer. Limits: Windows-centric workflow; no per-row indication of what came from the WAL.

kacos2000's WindowsTimeline

Costas Katsavounidis's repository accompanies the most detailed public research on the database (PDF). It offers a GUI parser, PowerShell scripts for live and offline databases, ready-made SQL queries, and clipboard tools that the author reports recover deleted clipboard entries from both the database and the WAL (repository).

Strengths: research depth; carving; SQL you can read and adapt. Limits: Windows tooling; SQL queries need a SQLite build with JSON support.

Plaso

Plaso's windows_timeline plugin requires the Activity and Activity_PackageId tables and emits events for user engagement and generic activities (source). Use it when Timeline is one input among hundreds and you want everything on one axis.

Strengths: super-timeline integration. Limits: less Timeline-specific detail than a dedicated parser; check its documentation for how your version treats -wal files.

Velociraptor

Windows.Forensics.Timeline targets C:\Users\*\AppData\Local\ConnectedDevicesPlatform\*\ActivitiesCache.db and is documented as deprecated in favour of Generic.Forensic.SQLiteHunter (Velociraptor docs). Use it for hunting across many endpoints, or to collect the files for offline parsing.

DB Browser for SQLite and SQL

Possible, instructive, and risky on evidence. A normal client will read and may checkpoint the WAL (sqlite.org). Only ever open a copy, and remember that JSON payloads and Base64 clipboard content need decoding by hand.

Windows Timeline Parser (this site)

What it does, as implemented:

• Own read-only SQLite reader in Rust, compiled to WebAssembly, running in a Web Worker. No SQLite engine, no write path, no upload.
• WAL replay: checksum-validated, committed transactions only; uncommitted frames ignored; a WAL that does not fit the database is detected and ignored with a warning.
• Per-row WAL status: only in WAL, changed in WAL, or checkpointed (why that matters).
• Decoding: AppId resolved with known folder GUIDs, contentUri turned into a path, focus seconds, user time zone, Base64 clipboard text.
• Intake: loose files, folders and ZIP triage collections; each database paired with its WAL; owner derived from the path.
• Triage: flags for clipboard, WAL-only, deletions, user-writable folders, other drives and network paths; filters; UTC/local; CSV (formula-injection safe) and JSON.

What it does not do: carve deleted records, parse Metadata or ActivityAssetCache, stream very large databases. It is newer than WxTCmd and has less field mileage, which is exactly why we recommend a second parser for critical findings.

Side by side

Which one when

• Lab workflow with KAPE, Timeline Explorer, reports: WxTCmd.
• Deleted clipboard data, research: kacos2000's tools.
• Everything on one timeline: Plaso.
• Hundreds of endpoints: Velociraptor.
• One laptop, no install rights, need an answer in five minutes, or a second opinion on WAL content: the Windows Timeline Parser, following the step-by-step guide.

FAQ

What is the standard tool for parsing ActivitiesCache.db?

Eric Zimmerman's WxTCmd is a widely used free command-line parser. It exports the Activity, ActivityOperation and Activity_PackageId tables to CSV and fits into KAPE workflows.

Does WxTCmd process the -wal file?

Its README does not mention the WAL. It opens the database through a SQLite library, and SQLite reads a -wal that sits next to the database. Keep the WAL beside the copy you parse, and parse copies only, because SQLite may checkpoint and delete the WAL on close.

Related articles

• Windows Timeline vs SRUM vs Prefetch vs Jump Lists
• Complete guide to Windows Timeline forensics