Skip to content

Glossary

ActivityOperation table

The ActivitiesCache.db table of queued insert, update and delete operations, where entries a user removed from Timeline leave a delete trace.

ActivityOperation holds operations waiting to be synchronised, with an OperationType of 1 (insert), 2 (update) or 3 (delete) and a CreatedTime for when the operation was queued. kacos2000 found that removing a tile from Timeline copies the entry here with a deleted status (kacos2000).

A delete operation is therefore timestamped evidence of a clean-up attempt. The Windows Timeline Parser flags these rows as deletions. See Windows Timeline limitations and anti-forensics.