Home How To Windows 10 Timeline Forensic Artefacts

Windows 10 Timeline Forensic Artefacts


Alex Caithness has published a post in CCL Group blog overviewing the newest Windows 10 feature – the Timeline. All Timeline data is stored in ActivitiesCache.db, which can be examined with a SQLite browser of your choice. The database is stored, according to the post, under “%APPDATA%\ConnectedDevicesPlatform\AAD.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\”, but we have found it under “C:\Users\%USERNAME%\AppData\Local\ConnectedDevicesPlatform\L.%USERNAME%”.

Load More Related Articles
Load More In How To
Comments are closed.