Belongs to the "Program Execution" group
Windows Timeline
Start
Allows users to go back and see what they did on nay specific day at any time, within the past thirty days.
The timeline contains a complete history of the user's activity on a device, allowing us to see exactly what they were doing and when. It is extremely accurate for data collection from internal windows apps like office and edge. It can be used very effectively in combination with other artefacts to create a full course of events and user habits.
How can we use it?
+info
Where can the timeline be found?
C:\Users\<USERNAME>\AppData\Local\ConnectedDevicesPlatform\ActivitiesCache.db
The timeline is stored as a SQLite database and includes:
- Opened files
- Applications
- Browser history
Windows Timeline
James
Created on March 4, 2025
Start designing with a free template
Discover more than 1500 professional designs like these:
View
Essential Microsite
View
Practical Microsite
View
Akihabara Microsite
View
Essential CV
View
Akihabara Resume
View
Interactive Onboarding Guide
View
Basic Shapes Microsite
Explore all templates
Transcript
Belongs to the "Program Execution" group
Windows Timeline
Start
Allows users to go back and see what they did on nay specific day at any time, within the past thirty days.
The timeline contains a complete history of the user's activity on a device, allowing us to see exactly what they were doing and when. It is extremely accurate for data collection from internal windows apps like office and edge. It can be used very effectively in combination with other artefacts to create a full course of events and user habits.
How can we use it?
+info
Where can the timeline be found?
C:\Users\<USERNAME>\AppData\Local\ConnectedDevicesPlatform\ActivitiesCache.db
The timeline is stored as a SQLite database and includes: