Skip to content

Glossary

ActivitiesCache.db

The per-user SQLite database behind Windows Timeline and activity history, stored under ConnectedDevicesPlatform in the user's local AppData folder.

ActivitiesCache.db is the SQLite database in which Windows 10 (from version 1803) records a user's activity history: applications engaged with, files and pages opened, focus time per app and, in some configurations, clipboard text. It lives at %LOCALAPPDATA%\ConnectedDevicesPlatform\<account-folder>\ and runs in write-ahead-log mode, so it comes with an ActivitiesCache.db-wal file that must be collected with it.

The tables that matter are Activity, ActivityOperation and Activity_PackageId. See the complete guide to Windows Timeline forensics and where it is stored.