Skip to content

Glossary

ClipboardPayload

The ActivitiesCache.db column holding clipboard content for type 10 activities, as a JSON array with Base64-encoded text and a format name.

ClipboardPayload stores what a user copied, when Windows records clipboard content in the activity history. The value is a JSON array like [{"content": "<base64>", "formatName": "Text"}]; decoding the Base64 yields the text (inversecos).

Clipboard content was reported only with clipboard history and cross-device sync enabled, and it expires after 12 hours (kacos2000). See clipboard history forensics in ActivitiesCache.db.