Posts tagged: #tools

A fair comparison of Windows Timeline parsers: WxTCmd, kacos2000's tools, Plaso, Velociraptor, SQL queries and this browser parser, including WAL handling.

Step-by-step: open ActivitiesCache.db and its -wal in a free browser-based viewer, filter apps, files, focus time and clipboard, and export CSV or JSON.