Clipboard Forensics Cheat Sheet

What it is

Since Windows 10 version 1809, pressing Win+V opens a clipboard history that keeps several recent copies instead of only the last one. The history itself is managed in memory by the per-user Clipboard User Service (cbdhsvc_<suffix>, hosted in svchost.exe) and is cleared at every restart. What reaches the disk depends on user settings:

Pinned items are written to the user profile so they survive reboots.
If "Sync across your devices" (cloud clipboard) is on as well, copied text is also recorded in the Windows Timeline database, ActivitiesCache.db, for about 12 hours.

Be precise in reports: with default settings (history off, sync off) no clipboard content is written to disk; only memory, the pagefile or hibernation file can hold it.

Location

Item	Location	Persists?
Settings	`NTUSER.DAT\Software\Microsoft\Clipboard` (`EnableClipboardHistory`, `EnableCloudClipboard`, `CloudClipboardAutomaticUpload`)	Yes
Live history (up to 25 items)	Memory of the Clipboard User Service	Until reboot or sign-out
Pinned items	`%LOCALAPPDATA%\Microsoft\Windows\Clipboard\Pinned\<GUID>\` with `metadata.json` and data files	Yes, until unpinned
History folder	`%LOCALAPPDATA%\Microsoft\Windows\Clipboard\HistoryData\`	Created when history is enabled
Cloud clipboard entries	`%LOCALAPPDATA%\ConnectedDevicesPlatform\<id>\ActivitiesCache.db` (+ `-wal`, `-shm`)	About 12 hours per entry
Paged-out memory	`C:\pagefile.sys`, `C:\hiberfil.sys`	Until overwritten

What it proves

Copied content: the exact text of a copy operation (from ActivitiesCache.db or memory), useful for passwords, account numbers, commands or data prepared for exfiltration.
Source application: the app that the copy came from (the Payload/AppId of the activity).
Timing: when the copy happened (StartTime) within the retention window.
User configuration: whether history and cloud sync were enabled, which tells you what evidence to expect.
It does not prove the text was pasted anywhere, and an empty result proves nothing when sync was off.

Key fields

Field	Meaning
`EnableClipboardHistory` (DWORD)	1 = clipboard history (Win+V) enabled
`EnableCloudClipboard` (DWORD)	1 = sync across devices enabled
`CloudClipboardAutomaticUpload` (DWORD)	1 = copied items are synced automatically
`ActivityType` = 10	Clipboard content held by the timeline database
`ActivityType` = 16	Copy/paste operation record
`ClipboardPayload`	JSON with the copied text Base64-encoded; check both the `Activity` and `ActivityOperation` tables
`Payload` / `AppId`	Application the data was copied from
`metadata.json` (pinned)	Pinned items with the time they were pinned

Timestamps

Timestamp	Set when	Format	Pitfalls
`StartTime`	Text copied to the clipboard	Unix epoch seconds, UTC	Only within the 12-hour window
`ExpirationTime`	Scheduled removal	Unix epoch seconds, UTC	Always about 12 hours after `StartTime`
`LastModifiedTime`	Record last modified	Unix epoch seconds, UTC	Not the copy time; use `StartTime`
`metadata.json` pin time, `Pinned\<GUID>` folder creation	Item pinned	JSON timestamp / NTFS, UTC	Records pinning, not the original copy
`Software\Microsoft\Clipboard` key last write	Setting changed	FILETIME, UTC	Shows when the user toggled history or sync

Retention and clearing

The in-memory history holds up to 25 items and is cleared at restart; signing out also clears it.
Cloud clipboard rows in ActivitiesCache.db expire after about 12 hours; remnants can linger in the WAL and free pages until overwritten (SQLite WAL).
Unpinning deletes the item's folder under Pinned; pinned data files appear encrypted or encoded, so the content is not directly readable.
"Clear" in the Win+V panel removes unpinned items; turning history off stops collection.
Memory copies can be paged out to pagefile.sys or saved in hiberfil.sys, which may outlive the 12-hour window.

Collection

KAPE target: WindowsTimeline (collects ActivitiesCache.db*). No target exists for the Clipboard\Pinned folder; copy it manually. Registry settings come with RegistryHivesUser.
Velociraptor (Windows.Triage.Targets): WindowsTimeline; the Exchange artifact Windows.Forensics.Clipboard decodes clipboard rows on live systems.
Memory first: on a live system, capture RAM before anything else (order of volatility); a reboot destroys the history.

reg query HKCU\Software\Microsoft\Clipboard
robocopy C:\Users\alice\AppData\Local\ConnectedDevicesPlatform E:\case\CDP ActivitiesCache.db* /S /COPY:DAT
robocopy C:\Users\alice\AppData\Local\Microsoft\Windows\Clipboard E:\case\Clipboard /E /COPY:DAT

Parsing tools

WxTCmd (Eric Zimmerman): parses ActivitiesCache.db to CSV, including ActivityType; decode the Base64 clipboard content afterwards.
DB Browser for SQLite: filter ActivityType = 10 and decode ClipboardPayload (CyberChef or PowerShell [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(...))).
Velociraptor: Windows.Forensics.Clipboard (Exchange) and the Generic.Forensic.SQLiteHunter extra, which decodes clipboard payloads from ActivitiesCache.db.
Volatility 2 clipboard plugin: reads clipboard structures from a memory image; for Win+V history, dump the cbdhsvc service process and search it for strings.

Investigation tips

Check the Clipboard registry values first: they tell you whether to expect cloud clipboard rows, pinned items, or memory-only data.
Clipboard rows are short-lived: prioritise collection of ActivitiesCache.db with its WAL when an incident is recent.
Pair a copied password or file path with the Windows Timeline activity of the source app and with process execution to reconstruct the session.
Search pagefile.sys and hiberfil.sys for copied strings you already know, to extend beyond the 12-hour window.
Users often keep secrets in pinned clipboard items or Sticky Notes; review both in credential-theft cases.
Behaviour was documented on Windows 10; validate on a matching Windows 11 build before stating that absence of rows is meaningful.

Clipboard history

Tools