Skip to content
Timelineparser

Posts tagged: #investigation

← Back to all posts
Windows Timeline Investigation: An Exfiltration Case
A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file.
windows-timelineactivitiescacheinvestigationclipboard
Clipboard History Forensics in ActivitiesCache.db
How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding.
windows-timelineactivitiescacheclipboardinvestigation
Does Windows Timeline Prove Execution or File Access?
What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.
windows-timelineactivitiescacheprogram-executioninvestigation