WindowsTimeline

Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)


Project maintained by kacos2000 Hosted on GitHub Pages — Theme by mattgraham

Note: Starting in July 2021, if you have your activity history synced across your devices through your Microsoft account (MSA), you’ll no longer have the option to upload new activity in Timeline. You’ll still be able to use Timeline and see your activity history (information about recent apps, websites and files) on your local device. AAD-connected accounts won’t be impacted. source

Windows 10 Timeline


SQLite queries to parse Windows 10 (1803+) Timeline’s ActivitiesCache.db Database

Either import the queries (.sql file) to your SQLite program, or Copy/Paste the code to a query tab. Your software needs to support the SQLIte JSON1 extension.

SQLite Tables processed:


Related content:

(5/2019)

» Revised query « for Windows Timeline - works with all versions (1803,1809,1903+) and is based on the smartlookup view. (Tested on Win10 pro 1903 (Build 19023.1))


Other queries (Win10 - 1803): (Build 19023.1)

  1. A re-formated Smartlookup view query - Smartlookup is a view included in ActivitiesCache.db. This query makes it a bit more readable but does not extract the data in the BLOBs (does not need the JSON1 extension).
  2. Activity_PackageID timeline query - Creates a timeline according to the Expiry Dates in the Activity_PackageID table. pid
  3. PackageID check - Check that the ‘PackageID’ in the ‘Activity.AppId’ json field has the same value as the ‘Activity_PackageId’ table’s ‘PackageName’ field (for x_exe and Windows_win32 entries).
  4. App_Platform - A simple query to help understand the different PlatformID combinations (extracted from the AppID json field)

Other queries (Win10 - 1809/1903):

  1. A re-formated Smartlookup view query (1809/1903) - Smartlookup for Win10 v1809 ActivitiesCache.db. (does not need the JSON1 extension).
  2. WindowsTimeline (1809/1903) - Full SQLite query that works with Win10 v1809/1903 ActivitiesCache.db. Will not work with earlier Windows versions (1803) as the latest Windows version has more dB fields.
  3. WindowsTimeline (1903) - Full SQLite query that works with Win10 v1903 ActivitiesCache.db. Will not work with earlier Windows versions (1803/1809) as the latest Windows version 1903 (19H1) has more dB fields. Now copy/paste operations can be seen as well as clipboard text (Base64 encoded):

    1903_screenshot

    –> Clipboard copy/paste operations (1903) - SQLite query to get just clipboard related data. ______________________________

Tested on:

Related Windows Apps

Status