Windows Timeline vs SRUM vs Prefetch vs Jump Lists
Windows Timeline, SRUM, Prefetch and Jump Lists compared: what each records, where it lives, how long it lasts and which question each one answers best.
TL;DR. Timeline tells you what a user engaged with, with focus time and file paths, per account. SRUM tells you how much CPU, disk and network each app used, hour by hour, per user SID. Prefetch tells you a binary ran, how many times, and its last run times, system-wide. Jump Lists tell you which files a user opened with which app. They overlap on purpose; use them together.
Each of these artifacts is a partial witness. The skill is knowing which one to ask first, and which one to call when the first goes quiet.
At a glance
| Windows Timeline | SRUM | Prefetch | Jump Lists | |
|---|---|---|---|---|
| File | ActivitiesCache.db (+ -wal) | SRUDB.dat | *.pf | *.automaticDestinations-ms, *.customDestinations-ms |
| Location | %LOCALAPPDATA%\ConnectedDevicesPlatform\<account>\ | C:\Windows\System32\sru\ | C:\Windows\Prefetch\ | %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\ and CustomDestinations\ |
| Format | SQLite, WAL mode | ESE database | Binary (compressed on Windows 10 and later) | OLE compound file with LNK entries and a DestList |
| Scope | Per user account | System, with user SID per record | System | Per user, per application |
| Key content | Apps, files, pages, focus seconds, clipboard | Per-app CPU, bytes read/written, network bytes | Run count, last run times, files loaded | Files and folders opened by an app, with times |
| Duration of use | Yes (activeDurationSeconds) | Foreground/background usage per hour | No | No |
| Network volume | No | Yes | No | No |
| Proves execution | Implies it for apps with user activity | Strong indicator | Most direct | Implies the app was used |
| Retention | 30 days per row; 12 h for clipboard | Limited; check the oldest record | Fixed number of files per system | No time-based expiry field |
| Windows 11 | View retired; content varies | Present | Present (workstations) | Present |
| Sources | kacos2000 | Magnet Forensics, Khatri 2015 | libscca documentation | dtformats documentation |
Parsers for each, in the browser: Windows Timeline Parser, SRUM parser, Prefetch parser, Jump List parser.
Windows Timeline: the user's attention
Timeline is the only one of the four that records what the user was looking at, and for how long. A type 6 row gives focus time for an app between two timestamps; a type 5 row gives the file or page opened. Clipboard rows, when present, give the text itself (clipboard forensics).
Where it wins: "was the user actively working in this tool, or did it just run?"; "which file did they open from the USB drive?"; "what did they copy?".
Where it is weak: execution without a window, activity older than 30 days, Windows 11 systems where the database is thin (Windows 11 status), and anything a user cleared (limitations).
SRUM: the resource meter
The System Resource Usage Monitor stores per-application usage in C:\Windows\System32\sru\SRUDB.dat, an ESE database, written roughly hourly and at shutdown (Magnet Forensics). Its application resource and network usage tables carry the app path and the user SID (Khatri, Digital Investigation, 2015).
Where it wins: bytes sent by rclone.exe in a given hour, which no other artifact here can show; activity by apps that never took focus; a retention window independent of Timeline's.
Where it is weak: hourly granularity; no file names; data held in memory or the registry until flushed.
Prefetch: the execution record
Prefetch files are created by the Windows prefetcher for executables launched on workstation editions. Recent formats hold a run count, up to eight last run times, and the list of files and directories the process loaded in its first seconds (libscca documentation).
Where it wins: "did this binary run, how many times, and when were the last runs?", regardless of user interaction. The loaded-files list can reveal files the program touched.
Where it is weak: no user attribution; the prefetcher can be disabled; the number of .pf files is capped, so old entries rotate out; server editions usually do not produce it.
Jump Lists: the recent-files list per app
Jump Lists are per-user, per-application lists of recently or frequently opened items. AutomaticDestinations files are OLE compound files holding LNK-format entries plus a DestList stream with access times and counts (dtformats documentation).
Where it wins: which files a user opened with a given app, including target volume information from the embedded LNK data; long memory, since there is no time-based expiry field.
Where it is weak: only apps that support Jump Lists; no duration; the application is identified by an AppID hash that you must map to a program.
Which one first?
| Question | Ask first | Then confirm with |
|---|---|---|
| Did this program run? | Prefetch | AmCache, SRUM, Timeline |
| Did the user work in it, and for how long? | Timeline | SRUM foreground usage |
| How much data did it send? | SRUM | Proxy / firewall logs |
| Which files did the user open? | Timeline and Jump Lists | LNK files, shellbags in the registry |
| Was a file on a USB drive or share opened? | Timeline (path), Jump Lists (volume data) | USB registry keys, LNK |
| What did the user copy? | Timeline (types 10 and 16) | Memory (RAM parser) |
| Did something happen more than a month ago? | Jump Lists, Prefetch | Shadow copies, USN journal |
A worked contrast
In the fictional svc_backup exfiltration case, each artifact adds a different piece:
- Timeline:
rclone.exein focus for 318 seconds fromC:\Users\Public\, therclone copycommand on the clipboard,Payroll_2026.xlsxopened fromE:\exfil. - SRUM would show the network bytes attributed to
rclone.exein the hour that followed. - Prefetch would give an
RCLONE.EXErun count and last run time, independent of any window. - Jump Lists for Excel would list
Payroll_2026.xlsxwith volume information forE:.
No single artifact tells the whole story. Timeline tells it in the most human terms, which is why it is worth collecting even when the others are present.
FAQ
Which artifact shows how long a user used an application?
Windows Timeline records active focus time per app in activeDurationSeconds. SRUM records foreground and background resource usage per app in hourly buckets. Prefetch and Jump Lists do not record duration.
Which artifact proves a program ran?
Prefetch is the most direct of the four for execution on workstations, with a run count and recent run times. Timeline shows interactive use, SRUM shows resource usage, and Jump Lists show files opened through an app.