A–Z
Glossary
Plain-language definitions of the Windows Timeline and SQLite forensics terms used across the blog.
- ActivityOperation table
- The ActivitiesCache.db table of queued insert, update and delete operations, where entries a user removed from Timeline leave a delete trace.
- SQLite freelist
- The list of unused pages in a SQLite database. Deleted rows can survive in free pages and freeblocks until they are reused or the file is vacuumed.
- ClipboardPayload
- The ActivitiesCache.db column holding clipboard content for type 10 activities, as a JSON array with Base64-encoded text and a format name.
- activeDurationSeconds
- The payload key in type 6 Windows Timeline activities that records how many seconds an application was in active use (focus) by the user.
- WAL checkpoint
- The SQLite operation that copies committed pages from the write-ahead log back into the main database file, after which the WAL can be reset and reused.
- Write-ahead log (WAL)
- SQLite's journaling mode in which committed changes are appended to a separate -wal file before being copied into the main database at a checkpoint.
- ActivityType
- The integer in ActivitiesCache.db that says what an activity row records: 5 opened, 6 in focus, 10 clipboard content, 16 copy or paste, 2 notification.
- AppId (JSON)
- The ActivitiesCache.db column that identifies the application as a JSON array of platform and application pairs, often with known folder GUIDs.
- Known folder GUID (KNOWNFOLDERID)
- A GUID that Windows uses to name a standard folder such as System32 or Program Files. Timeline AppId paths often start with one instead of a drive letter.
- ConnectedDevicesPlatform
- The Windows component and per-user folder that hosts ActivitiesCache.db, with one subfolder per account: L.<username> for local accounts.
- WAL index (-shm file)
- The shared-memory file (-shm) that SQLite uses to find pages in the write-ahead log quickly. It can be rebuilt and holds no unique evidence.
- ActivitiesCache.db
- The per-user SQLite database behind Windows Timeline and activity history, stored under ConnectedDevicesPlatform in the user's local AppData folder.