Windows Timeline Forensics: ActivitiesCache.db Guide

TL;DR. Windows Timeline is a per-user SQLite database, ActivitiesCache.db, under %LOCALAPPDATA%\ConnectedDevicesPlatform\<account>\. It records apps the user engaged with, files and pages opened, focus time per app, and sometimes clipboard text. Collect it with its -wal file, read the Activity and ActivityOperation tables, convert Unix timestamps from UTC, and corroborate with other artifacts. It is rich on Windows 10 and uncertain on Windows 11: check, don't assume.

Most Windows artifacts answer one narrow question. Prefetch says a binary ran. Jump Lists say a file was opened through an application. Windows Timeline is unusual because it answers several at once, per user, with durations. That makes it one of the best sources for reconstructing what a person was doing at the keyboard, and one of the easiest to misread.

This guide is the entry point for the series. Each section links to a deeper article.

What Windows Timeline is

Timeline arrived with Windows 10 version 1803 (April 2018 Update) as part of the Connected Devices Platform, the service behind Microsoft's cross-device "pick up where you left off" features (kacos2000's examination of the database). Microsoft describes activity history as "the things you do on your device, such as the apps and services you use, the files you open, and the websites you browse", stored locally on the device (Microsoft Support).

The user-facing part was the Timeline view in Task View (Windows + Tab). Microsoft states that "the timeline user experience was retired in Windows 11, although it remains in Windows 10" (Microsoft Support: Get help with Timeline). The view went away; the question of what the database still holds on Windows 11 is covered in Windows 11 Timeline: is ActivitiesCache.db still useful?.

Where it is stored

Item	Value
Folder	`C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<account-folder>\`
Database	`ActivitiesCache.db` (SQLite 3)
Companion files	`ActivitiesCache.db-wal` (write-ahead log), `ActivitiesCache.db-shm` (shared-memory index)
Account folder	`L.<username>` for local accounts; a different identifier for Microsoft and work or school accounts
Scope	One database per user account folder

The ConnectedDevicesPlatform folder can hold more than one account folder for the same Windows user, for example after a switch from a local account to a Microsoft account. Collect the whole folder. Paths, account folder naming, KAPE targets and locked-file handling are detailed in where ActivitiesCache.db is stored and how to acquire it.

What is inside

The database has several tables. Three carry nearly all the investigative value (Group-IB, kacos2000):

Table	What it holds	Why you care
`Activity`	One row per activity: app, type, start/end, JSON payload, clipboard payload	The timeline itself
`ActivityOperation`	Queued operations (insert, update, delete) waiting for sync	Traces of entries the user removed from Timeline
`Activity_PackageId`	Package or executable names per activity, with expiry	Helps resolve the application

Each Activity row has an activity type. The ones you will meet most:

ActivityType	Meaning	Key data
5	App, file or page opened	`displayText`, `contentUri`, `appDisplayName` in the payload
6	App in use (focus)	`activeDurationSeconds`, `userTimezone`, start and end time
10	Clipboard content	Base64 text in `ClipboardPayload`
16	Copy or paste operation	`Group` column says copy or paste
2	Notification	Toast notification metadata

The application is identified by the AppId JSON, an array of platform/application pairs where system folders are written as known folder GUIDs. Every field is explained in ActivitiesCache.db activity types and payload fields.

Why the -wal file is not optional

ActivitiesCache.db runs in SQLite write-ahead-log mode. New and changed rows are appended to ActivitiesCache.db-wal; they reach the main file only when a checkpoint copies them back. SQLite's documentation is blunt about separating the two: "If a database file is separated from its WAL file, then transactions that were previously committed to the database might be lost" (sqlite.org/wal.html).

On a live or recently used machine, the last hours of activity are often only in the WAL. Parse the database alone and you get a timeline that stops before the interesting part. The mechanism and its forensic consequences are covered in why ActivitiesCache.db-wal matters.

What it can prove, and what it cannot

Question	Timeline answer	Confidence
Did the user open this file?	Type 5 row with the file path	Strong, per user account
How long did they use this app?	Type 6 `activeDurationSeconds`	Good, but compare with start/end
Which app was used on a USB drive or share?	Path on another drive letter or UNC path	Good for the path; the volume needs other artifacts
What did they copy?	Type 10 clipboard text, when present	Strong when present, rarely present
Did a program execute?	Only if it showed up as a user activity	Partial: absence proves nothing
When exactly, in local time?	Unix seconds in UTC plus `userTimezone`	Good, if you convert explicitly

The interpretation rules, including why a Timeline row is evidence of engagement rather than of process creation, are in does Windows Timeline prove execution or file access?.

A workflow that holds up

Acquire the whole ConnectedDevicesPlatform folder for every user, from a disk image or a triage collection. Keep the Users\<name>\ structure so each database is attributed to its account.
Hash what you collected before opening anything with a tool that might write to it. A standard SQLite library can checkpoint and delete the WAL when it closes the database (sqlite.org); work on copies.
Parse the database and its WAL together. Note which rows exist only in the WAL: those are the most recent, and the ones a report will lean on.
Normalise time. Store UTC; convert to local with the payload's userTimezone only for the narrative.
Filter by the question: type 5 for files opened, type 6 for engagement, types 10 and 16 for clipboard, ActivityOperation with operation type 3 for deletions.
Corroborate with SRUM, Prefetch, LNK files, Jump Lists and event logs. The comparison is in Windows Timeline vs SRUM vs Prefetch vs Jump Lists.

The Windows Timeline Parser does steps 3 to 5 in the browser: drop the database and its WAL, and it replays committed WAL transactions, marks WAL-only and changed rows, decodes AppId and payloads, and exports CSV or JSON. Nothing is uploaded. A step-by-step walkthrough is in how to analyze ActivitiesCache.db in your browser.

Limits to keep in mind

Retention. Entries carry an ExpirationTime; kacos2000 measured it at exactly 30 days after the last modification, and 12 hours for clipboard entries (kacos2000).
Settings. The user or a policy can stop collection ("Store my activity history on this device") and clear history (Microsoft Support).
Coverage. Not every process produces an activity. Timeline is about user engagement.
Deleted records. Rows removed from the database can survive in free pages or old WAL frames, but most parsers, including this one today, do not carve them.

The full list, with anti-forensic moves and how to spot them, is in Windows Timeline limitations and anti-forensics.

FAQ

What is ActivitiesCache.db?

It is the per-user SQLite database behind Windows Timeline and activity history. It records which applications a user engaged with, which files and pages they opened, how long each app had focus and, in some configurations, clipboard text.

Which Windows versions have Windows Timeline?

Timeline shipped with Windows 10 version 1803. Microsoft retired the Timeline view in Windows 11, but the database can still exist on Windows 11 systems, so check for it rather than assume.

Do I need the -wal file?

Yes. The database runs in SQLite write-ahead-log mode, so recent changes sit in ActivitiesCache.db-wal until a checkpoint. Without it, the most recent activity is often missing.