https://www.windowstimelineparser.com/en/blog Latest from Blog en Sun, 27 Sep 2026 20:44:08 GMT https://www.windowstimelineparser.com/en/blog/activitiescache-parsers-compared https://www.windowstimelineparser.com/en/blog/activitiescache-parsers-compared A fair comparison of Windows Timeline parsers: WxTCmd, kacos2000's tools, Plaso, Velociraptor, SQL queries and this browser parser, including WAL handling. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-timeline-vs-srum-prefetch-jump-lists https://www.windowstimelineparser.com/en/blog/windows-timeline-vs-srum-prefetch-jump-lists Windows Timeline, SRUM, Prefetch and Jump Lists compared: what each records, where it lives, how long it lasts and which question each one answers best. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-timeline-anti-forensics-limitations https://www.windowstimelineparser.com/en/blog/windows-timeline-anti-forensics-limitations Where Windows Timeline evidence runs out: expiry, settings, cleared history, deleted rows, WAL gaps and parser limits, plus how to detect deliberate tampering. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-timeline-exfiltration-investigation https://www.windowstimelineparser.com/en/blog/windows-timeline-exfiltration-investigation A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-clipboard-history-forensics https://www.windowstimelineparser.com/en/blog/windows-clipboard-history-forensics How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-timeline-proof-of-execution https://www.windowstimelineparser.com/en/blog/windows-timeline-proof-of-execution What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/analyze-activitiescache-db-in-browser https://www.windowstimelineparser.com/en/blog/analyze-activitiescache-db-in-browser Step-by-step: open ActivitiesCache.db and its -wal in a free browser-based viewer, filter apps, files, focus time and clipboard, and export CSV or JSON. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-11-timeline-activitiescache https://www.windowstimelineparser.com/en/blog/windows-11-timeline-activitiescache Windows 11 retired the Timeline view, but ActivitiesCache.db can still be on disk. What changed, what sources say, and how to check a Windows 11 image yourself. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/activitiescache-wal-file-sqlite-forensics https://www.windowstimelineparser.com/en/blog/activitiescache-wal-file-sqlite-forensics How SQLite write-ahead logging hides the newest Windows Timeline activity in ActivitiesCache.db-wal, how checkpoints work, and how to parse the WAL safely. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/activitiescache-activity-types-payload https://www.windowstimelineparser.com/en/blog/activitiescache-activity-types-payload Field reference for ActivitiesCache.db: ActivityType values 5, 6, 10 and 16, the AppId JSON, payload keys like activeDurationSeconds and every timestamp column. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/activitiescache-db-location-acquisition https://www.windowstimelineparser.com/en/blog/activitiescache-db-location-acquisition Where ActivitiesCache.db lives for local, Microsoft and work accounts, and how to collect it with its -wal file from images, KAPE, Velociraptor or live systems. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.windowstimelineparser.com/en/blog/windows-timeline-forensics-guide https://www.windowstimelineparser.com/en/blog/windows-timeline-forensics-guide Complete guide to Windows Timeline forensics: what ActivitiesCache.db records, where it lives, why the -wal file matters and how to read it in a case. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT