Posts tagged: #activitiescache

A fair comparison of Windows Timeline parsers: WxTCmd, kacos2000's tools, Plaso, Velociraptor, SQL queries and this browser parser, including WAL handling.

Where Windows Timeline evidence runs out: expiry, settings, cleared history, deleted rows, WAL gaps and parser limits, plus how to detect deliberate tampering.

A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file.

How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding.

What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.

Step-by-step: open ActivitiesCache.db and its -wal in a free browser-based viewer, filter apps, files, focus time and clipboard, and export CSV or JSON.

Windows 11 retired the Timeline view, but ActivitiesCache.db can still be on disk. What changed, what sources say, and how to check a Windows 11 image yourself.

How SQLite write-ahead logging hides the newest Windows Timeline activity in ActivitiesCache.db-wal, how checkpoints work, and how to parse the WAL safely.

Field reference for ActivitiesCache.db: ActivityType values 5, 6, 10 and 16, the AppId JSON, payload keys like activeDurationSeconds and every timestamp column.

Where ActivitiesCache.db lives for local, Microsoft and work accounts, and how to collect it with its -wal file from images, KAPE, Velociraptor or live systems.

Complete guide to Windows Timeline forensics: what ActivitiesCache.db records, where it lives, why the -wal file matters and how to read it in a case.