WindowsTimeline

SQLite query & Powershell scripts to parse the Windows 10 (v1803) ActivitiesCache.db


Project maintained by kacos2000 Hosted on GitHub Pages — Theme by mattgraham

Windows 10 Timeline

NEW (5/2019)

» Revised query « for Windows Timeline - works with all versions (1803,1809,1903+) and is based on the smartlookup view #dfir. (Tested on Win10 pro 1903 OS Build 18895.1000)

SQLite queries to parse Windows 10 (1803+) Timeline’s ActivitiesCache.db Database

Either import the queries (.sql file) to your SQLite program, or Copy/Paste the code to a query tab. Your software needs to support the SQLIte JSON1 extension.


SQLite Tables processed:

Other queries (Win10 - 1803): (Build 17754.1 17744.rc5_release.180818-1845 )

  1. A re-formated Smartlookup view query - Smartlookup is a view included in ActivitiesCache.db. This query makes it a bit more readable but does not extract the data in the BLOBs (does not need the JSON1 extension).
  2. Activity_PackageID timeline query - Creates a timeline according to the Expiry Dates in the Activity_PackageID table. pid
  3. PackageID check - Check that the ‘PackageID’ in the ‘Activity.AppId’ json field has the same value as the ‘Activity_PackageId’ table’s ‘PackageName’ field (for x_exe and Windows_win32 entries).
  4. App_Platform - A simple query to help understand the different PlatformID combinations (extracted from the AppID json field)

Other queries (Win10 - 1809/1903):

  1. A re-formated Smartlookup view query (1809/1903) - Smartlookup for Win10 v1809 ActivitiesCache.db. (does not need the JSON1 extension).
  2. WindowsTimeline (1809/1903) - Full SQLite query that works with Win10 v1809/1903 ActivitiesCache.db. Will not work with earlier Windows versions (1803) as the latest Windows version has more dB fields.
  3. WindowsTimeline (1903) - Full SQLite query that works with Win10 v1903 ActivitiesCache.db. Will not work with earlier Windows versions (1803/1809) as the latest Windows version 1903 (19H1) has more dB fields. Now copy/paste operations can be seen as well as clipboard text (Base64 encoded):

    1903_screenshot

    –> Clipboard copy/paste operations (1903) - SQLite query to get just clipboard related data. ______________________________

Tested on:

Related Windows Apps

Status