Windows Timeline Forensics Cheat Sheet

What it is

Windows Timeline, introduced in Windows 10 version 1803, is the "activity history" behind the Win+Tab view: Windows records the applications a user works in, the documents and web pages opened, and how long each app stayed in focus. The data sits in a per-user SQLite database, ActivitiesCache.db, managed by the Connected Devices Platform. For Windows 10 investigations it is one of the richest per-user activity sources, combining evidence of execution, file access and duration of use in one place.

Location

Windows version	Path	Notes
10 (1803 and later)	`C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<account>\ActivitiesCache.db`	Plus `ActivitiesCache.db-wal` and `-shm`
11	same path, when present	Timeline was removed from Windows 11; the database may remain (notably on upgraded systems) but no longer records the rich app and file activity of Windows 10

The <account> folder is L.<username> for a local account, or an identifier tied to the Microsoft or work account. Always collect the -wal file: recent records are often only there.

What it proves

Application use: an app was opened (type 5) and was in the foreground for a measured period (type 6), for Win32 and UWP apps.
Files and URLs opened: many records reference the document or web page opened by the app, with its path or URI.
Duration: start and end times of focus sessions show how long the user actively worked in an app.
Clipboard: with clipboard history and cross-device sync enabled, copied text can be stored (types 10 and 16).
It is per user and records interactive activity; it does not cover services, scheduled tasks or anything that runs without a user session.
It depends on the activity-history setting, and on Windows 11 its absence proves nothing.

Key fields

Field	Meaning
`Activity` table	One row per activity: `AppId`, `ActivityType`, `Payload`, times, `PlatformDeviceId`, `ClipboardPayload`
`ActivityOperation` table	Operations queued for the activity feed (for example pending uploads or deletions); can hold rows missing from `Activity`
`Activity_PackageId` table	Package names and executable paths of each app, per platform, with expiration time
`AppId`	JSON list identifying the application (Win32 path, package family name)
`ActivityType`	5 = open app/file/URL, 6 = app in focus, 10 = clipboard, 16 = copy/paste; 2 = notification; 3, 11, 12 and 15 relate to system operations (backup, credentials, Wi-Fi, personalization)
`Payload`	JSON with details such as display text, description and content URI of the file or page
`ClipboardPayload`	Base64-encoded copied text (types 10/16)
`PlatformDeviceId`	Identifier of the device that produced the activity

Timestamps

Timestamp	Set when	Format	Pitfalls
`StartTime`	Activity began (app opened or focus gained)	Unix epoch seconds, UTC	Some tools display it in local time: check the time zone setting
`EndTime`	Focus session ended (type 6)	Unix epoch seconds, UTC	`EndTime - StartTime` = focus duration; 0 or empty for open events
`LastModifiedTime`	Record last updated	Unix epoch seconds, UTC	Not the time of the user action; prefer StartTime and EndTime
`ExpirationTime`	When the record will be purged	Unix epoch seconds, UTC	About 30 days after the activity
`LastModifiedOnClient`, `CreatedInCloud`	Client and cloud synchronization bookkeeping	Unix epoch seconds, UTC	Describe sync state rather than user activity

Retention and clearing

Records expire roughly 30 days after the activity (ExpirationTime); clipboard records last about 12 hours.
Collection is controlled by Settings > Privacy > Activity history ("Store my activity history on this device") and by Group Policy (EnableActivityFeed, PublishUserActivities). A user can also clear the history from the same page.
Deleted or expired rows may still sit in the WAL file or in SQLite free pages until they are overwritten; parse the database with and without the WAL.
Older copies of the database may exist in volume shadow copies.

Collection

KAPE target: WindowsTimeline (all ActivitiesCache.db* files under every profile's ConnectedDevicesPlatform folder).
Velociraptor (Windows.Triage.Targets): WindowsTimeline. The older Windows.Forensics.Timeline artifact queries the database live; its description marks it as deprecated in favour of Generic.Forensic.SQLiteHunter.
Built-in: the database is held open while the user is logged on; copy it with its WAL through a shadow copy:

esentutl.exe /y "C:\Users\alice\AppData\Local\ConnectedDevicesPlatform\L.alice\ActivitiesCache.db" /vss /d E:\case\alice\ActivitiesCache.db
esentutl.exe /y "C:\Users\alice\AppData\Local\ConnectedDevicesPlatform\L.alice\ActivitiesCache.db-wal" /vss /d E:\case\alice\ActivitiesCache.db-wal

Parsing tools

WxTCmd (Eric Zimmerman, free): WxTCmd.exe -f ActivitiesCache.db --csv E:\out produces activity and package-ID CSVs with durations and decoded payloads.
SQLECmd (Eric Zimmerman, free): ships a map for ActivitiesCache.db.
WindowsTimeline (kacos2000, free): SQLite queries and a parser, with detailed documentation of the ActivityType values.
Velociraptor: Windows.Forensics.Timeline (deprecated) or the SQLiteHunter artifact.
Plaso: windows_timeline SQLite plugin for super timelines.

Investigation tips

Use type 6 focus sessions to show that a user actively worked in a tool (remote-access client, archiver, cloud sync app) and for how long; this complements SRUM and UserAssist focus time.
Extract file paths and URLs from Payload to find documents opened just before an exfiltration or a suspicious logon.
Decode ClipboardPayload when present: copied passwords, commands or IBANs appear in clear text after Base64 decoding (see also clipboard history).
Compare PlatformDeviceId values: activities synced from another device of the same account can appear in the database.
Correlate app executions with Prefetch and BAM to confirm times and the executable path.
On Windows 11, check whether the database has recent content before relying on it; if not, fall back on Jump Lists and SRUM.

Windows Timeline (ActivitiesCache.db)

Tools