Skip to content
Timelineparser

Posts tagged: #clipboard

← Back to all posts
Windows Timeline Investigation: An Exfiltration Case
A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file.
windows-timelineactivitiescacheinvestigationclipboard
Clipboard History Forensics in ActivitiesCache.db
How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding.
windows-timelineactivitiescacheclipboardinvestigation