Series
Windows Timeline fundamentals
5 posts in this series. Read them in order or jump to any one.
- Windows Timeline Forensics: ActivitiesCache.db Guide
Complete guide to Windows Timeline forensics: what ActivitiesCache.db records, where it lives, why the -wal file matters and how to read it in a case.
- ActivitiesCache.db Location and Acquisition Guide
Where ActivitiesCache.db lives for local, Microsoft and work accounts, and how to collect it with its -wal file from images, KAPE, Velociraptor or live systems.
- ActivitiesCache.db Activity Types and Payload Fields
Field reference for ActivitiesCache.db: ActivityType values 5, 6, 10 and 16, the AppId JSON, payload keys like activeDurationSeconds and every timestamp column.
- ActivitiesCache.db-wal: Why the WAL File Matters
How SQLite write-ahead logging hides the newest Windows Timeline activity in ActivitiesCache.db-wal, how checkpoints work, and how to parse the WAL safely.
- Windows 11 Timeline: Is ActivitiesCache.db Still Useful?
Windows 11 retired the Timeline view, but ActivitiesCache.db can still be on disk. What changed, what sources say, and how to check a Windows 11 image yourself.