Does Windows Timeline Prove Execution or File Access?
What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.
TL;DR. A Timeline row is evidence of user engagement, per account: a type 5 row says an app opened a file or page; a type 6 row says an app was in focus for activeDurationSeconds. That implies execution for the app involved, and file access for the path shown. It does not prove that a program which is absent from Timeline never ran. Word findings as "the activity history of user X records...", corroborate with Prefetch, SRUM or process-creation events, and state which timestamp field you used.
Timeline invites overreach because it is so readable. A row that says "Payroll_2026.xlsx, Excel, 10:40" feels like a confession. It is strong evidence, but of something specific. This article pins down what.
What each row type supports
| Row | Supports | Does not support |
|---|---|---|
| Type 5, app with file path | The app opened that item, in that user's session, at StartTime | That the user read or edited the content; that the file still exists |
| Type 5, app only | The app was launched in a user-visible way | Command-line arguments, parent process |
| Type 6, focus | The app was in the foreground for about activeDurationSeconds between start and end | Which document was in that window (look at nearby type 5 rows) |
| Type 10 / 16 | Clipboard content / copy-paste events (clipboard article) | Where the text was pasted, unless a paste event exists |
ActivityOperation, delete | An entry was queued for deletion, typically by the user removing it (kacos2000) | Why it was removed |
Microsoft frames activity history as "the apps and services you use, the files you open, and the websites you browse" (Microsoft Support). It is a record of what a person did in the shell, not a process-creation log.
"It ran" versus "it's not there"
Present: if C:\Users\Public\rclone.exe has a type 6 row with 318 seconds of focus, the binary was running and in the foreground for roughly five minutes in that user's session. That is execution, and more: interactive use.
Absent: a missing row means little. Things that plausibly leave no Timeline activity:
- Services, scheduled tasks and processes started by other processes without a user-facing window.
- Tools run under a different account (the activity would be in that account's database, if anywhere).
- Activity while history collection was off, or after the user cleared it (Microsoft Support).
- Rows that expired (30 days after last modification in kacos2000's tests) (kacos2000).
- Rows still in a WAL that nobody collected (why the WAL matters).
For execution itself, use artifacts that record process creation or program runs. The ShimCache site explains why even that artifact is not proof of execution on its own; the same discipline applies here.
| Need | Better primary artifact |
|---|---|
| Program ran, with run count and times | Prefetch (format documentation) |
| Binary identity by hash | AmCache |
| Process creation with command line | Security 4688 or Sysmon 1 in event logs |
| Per-app resource use, hourly | SRUM |
File access: what the path tells you
The file path comes from the payload's contentUri (or description). The Windows Timeline Parser decodes it into a Windows path and flags three situations:
| Path pattern | Flag | Why it matters | Corroborate with |
|---|---|---|---|
E:\..., any drive other than C: | Other drive (USB?) | Removable media or another volume | LNK files (volume serial, drive type), USB registry keys via the registry parser |
\\server\share\... | Network path | Access to a file share | LNK files, SMB logs on the server, event logs |
...\Users\Public\..., AppData, Downloads, ProgramData, Windows\Temp | User-writable folder | Common staging locations | USN journal for creation and deletion |
The drive letter is what the user's session saw at the time. It does not identify the device. E: on Monday and E: on Tuesday can be two different USB sticks.
Focus time: read it carefully
activeDurationSeconds is the most quoted Timeline field and the easiest to misstate.
- It measures time the app was in use, not the time it was open. Two hours of an idle window behind another app is not two hours of focus.
- kacos2000 found the payload duration sometimes differs from
EndTime - StartTime, and that the first execution entry of a desktop app may have no duration at all (kacos2000). - A type 6 row is updated as the session continues. If the WAL holds a newer version of the row, the database alone shows a shorter session. The tool marks such rows Changed in WAL.
Say which one you used: "the payload records 318 seconds of active use between 10:47:12 and 10:52:30 UTC".
How to phrase findings
Weak: "Timeline shows the user exfiltrated Payroll_2026.xlsx."
Stronger: "The activity history database of user svc_backup (ActivitiesCache.db and its write-ahead log) records Excel opening E:\exfil\finance_2026\Payroll_2026.xlsx at 10:40:12 UTC on 14 September 2026. This row exists only in the WAL. Prefetch for EXCEL.EXE and the LNK file for Payroll_2026.xlsx are consistent with this."
The second version names the account, the source files, the field, the time zone, the WAL status and the corroboration. (The example is from the fictional scenario used on this site; see the walkthrough.)
Checklist before you write "the user did X"
- The database is attributed to the right account (profile path, not only the folder name).
- The WAL was parsed, and you know whether the row is WAL-only or changed in the WAL.
- Times are in UTC with the conversion stated.
- The claim matches the row type (opened vs in focus vs copied).
- At least one independent artifact agrees.
FAQ
Does a Windows Timeline entry prove a program was executed?
A type 5 or type 6 row for an executable means the user engaged with it through a window, which implies it ran. The absence of a row proves nothing: background processes, services and anything that never took focus can run without a Timeline entry.
Does Windows Timeline show files opened from USB drives?
Yes, when the file was opened in a way that created a type 5 activity. The path keeps the drive letter, for example E:\, but not the volume serial or device, so pair it with LNK, Jump List and registry evidence to identify the device.