Series
Investigating with Windows Timeline
5 posts in this series. Read them in order or jump to any one.
- How to Analyze ActivitiesCache.db in Your Browser
Step-by-step: open ActivitiesCache.db and its -wal in a free browser-based viewer, filter apps, files, focus time and clipboard, and export CSV or JSON.
- Does Windows Timeline Prove Execution or File Access?
What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.
- Clipboard History Forensics in ActivitiesCache.db
How Windows stores clipboard text in ActivitiesCache.db: activity types 10 and 16, the settings that enable it, the 12-hour expiry and Base64 decoding.
- Windows Timeline Investigation: An Exfiltration Case
A fictional walkthrough: reconstructing a service account's hands-on-keyboard session and a payroll exfiltration from ActivitiesCache.db and its WAL file.
- Windows Timeline Limitations and Anti-Forensics
Where Windows Timeline evidence runs out: expiry, settings, cleared history, deleted rows, WAL gaps and parser limits, plus how to detect deliberate tampering.