Windows 11 Timeline: Is ActivitiesCache.db Still Useful?
Windows 11 retired the Timeline view, but ActivitiesCache.db can still be on disk. What changed, what sources say, and how to check a Windows 11 image yourself.
TL;DR. Microsoft retired the Timeline view in Windows 11; the activity history settings remain and Microsoft still describes activity history as stored locally. Security researchers describe ActivitiesCache.db on Windows 11 as no longer actively maintained but still present. How populated it is varies, and there is no authoritative public statement on exactly what Windows 11 still writes. Collect it anyway, parse it, and report what you find, not what you expected.
"Windows 11 killed Timeline" is true for the user interface and too strong for the evidence. Analysts who skip the database on Windows 11 images are betting that it is empty. Sometimes they win the bet. This article lays out what is documented, what is not, and how to check in five minutes.
What Microsoft says
Three statements from Microsoft frame the question:
| Statement | Source |
|---|---|
| "The timeline user experience was retired in Windows 11, although it remains in Windows 10." | Get help with Timeline |
| Cross-device syncing of Microsoft Entra ID user activity history stops starting January 2024, aligning with the earlier change for Microsoft accounts in 2021. | Get help with Timeline |
| Activity history is "stored locally on your device"; the option to send it to Microsoft was deprecated in Windows 11 22H2 and 23H2 with the January 23, 2024 update (KB5034204). | Windows activity history and your privacy |
Read together: the viewer is gone, the cloud side is gone, and local activity history still exists as a concept with its own setting ("Store my activity history on this device"). None of these pages say which activity types Windows 11 writes to ActivitiesCache.db, or whether it writes any at all on a given build.
What researchers say
Kaspersky's 2025 overview of Windows 11 artifacts lists the removal of the Timeline artifact and states that, although it is no longer actively maintained, its database "remains for now" under %userprofile%\AppData\Local\ConnectedDevicesPlatform (Securelist). The article does not publish a per-build breakdown of what the database still receives.
Most of the detailed public research on this database (kacos2000, Group-IB, inversecos) was done on Windows 10 (kacos2000, Group-IB, inversecos). Forum and blog reports about Windows 11 range from "empty" to "only system entries". We have not found a reproducible public test that settles the question across Windows 11 releases, so we do not claim one.
Why a Windows 11 disk can still hold rich Timeline data
Even if a current Windows 11 build writes little, several situations put useful rows on a Windows 11 disk:
- In-place upgrade from Windows 10. The per-user
ConnectedDevicesPlatformfolder lives in the profile. Whether and when Windows cleans it after an upgrade is not documented; in practice, check for rows dated before the upgrade. - Expiry is per row. Rows carry an
ExpirationTime(30 days after last modification in kacos2000's tests), so an image taken soon after an upgrade can still hold Windows 10-era rows (kacos2000). - Shadow copies and backups. Older snapshots of the profile can hold an older database.
- Clipboard and system activity types. Settings-related and clipboard activity types are separate from the retired Timeline view; do not assume their behaviour changed in the same way.
How to check a Windows 11 image
- Collect
Users\*\AppData\Local\ConnectedDevicesPlatform\with the WAL (acquisition guide). - Drop the folder into the Windows Timeline Parser. Each account's database is paired with its WAL.
- Look at the counters: total activities, rows only in WAL, clipboard items, deletions.
- Sort by start time. Note the newest
StartTimeandLastModifiedTime, and compare them with the image date. - Filter by type. If you only see types other than 5 and 6, the database is not recording app and file engagement on this system.
- Check
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersionin the SOFTWARE hive (the registry parser reads it) for the build and install date, to line up with any gap in the Timeline.
Report the result factually: "ActivitiesCache.db for user X contains N activities between D1 and D2, of types ..., the most recent from the WAL." That sentence is defensible whether N is 0 or 5,000.
What to use when Timeline is thin
| Question | Windows 11 alternative |
|---|---|
| Which apps ran, how much | SRUM application usage, Prefetch, AmCache |
| Which files a user opened | Jump Lists, LNK files, RecentDocs and shellbags in the registry |
| Browser activity | Browser forensics |
| File system changes | USN journal |
On Copilot+ PCs with Recall enabled, Kaspersky describes a separate store under %AppData%\Local\CoreAIPlatform.00\UKP\ (Securelist). Recall is a different feature with its own format; it is not a new version of ActivitiesCache.db, and this site does not parse it.
The honest position
| Claim | Status |
|---|---|
| Timeline UI removed in Windows 11 | Documented by Microsoft |
| Activity history setting still present | Documented by Microsoft |
ActivitiesCache.db path still present on Windows 11 | Reported by Kaspersky and practitioners |
| What activity types current Windows 11 builds write | Not publicly documented; varies in reports |
| Database worth collecting on Windows 11 | Yes: cheap to collect, sometimes decisive |
FAQ
Does Windows 11 have Timeline?
Not as a user feature. Microsoft states that the Timeline user experience was retired in Windows 11 and remains in Windows 10. The activity history settings still exist.
Is ActivitiesCache.db on Windows 11 worth collecting?
Yes. It costs almost nothing to collect, and how much it contains varies by system, upgrade history and settings. Parse it and let the data answer rather than assuming it is empty.