Skip to content
Timelineparser

Blog

ActivitiesCache.db Activity Types and Payload Fields
Field reference for ActivitiesCache.db: ActivityType values 5, 6, 10 and 16, the AppId JSON, payload keys like activeDurationSeconds and every timestamp column.
windows-timelineactivitiescachesqlitedfir
ActivitiesCache.db Location and Acquisition Guide
Where ActivitiesCache.db lives for local, Microsoft and work accounts, and how to collect it with its -wal file from images, KAPE, Velociraptor or live systems.
windows-timelineactivitiescacheacquisitiondfir
Windows Timeline Forensics: ActivitiesCache.db Guide
Complete guide to Windows Timeline forensics: what ActivitiesCache.db records, where it lives, why the -wal file matters and how to read it in a case.
windows-timelineactivitiescachedfirsqlite