WindowsTimeline
ActivitiesCache.db collector
- 1 path
ActivitiesCache.db*- Per-user data
- Version 1.1
- Lee Whitfield, Thomas DIOT (Qazeer)
Paths on disk
1 path
Notes
There is a SQLECmd map for the ActivitiesCache.db database: https://github.com/EricZimmerman/SQLECmd/blob/master/SQLMap/Maps/Windows_ActivitiesCache.smap
References
8 links
- group-ib.com/blog/windows10_timeline_for_forensics(opens in new tab)
- kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf(opens in new tab)
- medium.com/@soji256/list-of-windows-10-timeline-analysis-articles-c61595b49e0d(opens in new tab)
- cellebrite.com/en/blog/exploring-the-windows-activity-timeline-part-1-the-high-points/(opens in new tab)
- andreafortuna.org/2019/10/03/some-forensic-thoughts-about-windows-10-timeline/(opens in new tab)
- salt4n6.com/2018/05/03/windows-10-timeline-forensic-artefacts/(opens in new tab)
- cyberforensicator.com/2018/05/08/wxtcmd-windows-10-timeline-parser/(opens in new tab)
- forensafe.com/blogs/wintimeline.html(opens in new tab)