Windows Timeline (ActivitiesCache)
Also called ActivitiesCache.db, ConnectedDevicesPlatform, Windows 10 Timeline forensics.
- PLATFORM
- Windows
- CATEGORY
- Program Execution
- INDEX
- 19 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
A per-user database recording application usage and the documents opened in each application, with start and end times and, where account sync was on, activity from the user's other devices.
Where it lives
%LocalAppData%\ConnectedDevicesPlatform\<profile>\ActivitiesCache.db
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of windows timeline (activitiescache)” is neither.
What it records
The activities database stores one row per activity, naming the application, a payload that frequently includes the document path or a description of the content, and start and expiration times giving a duration rather than a moment. Where the user signed in with a Microsoft account and sync was enabled, activities from other devices signed in to the same account appear in the local database. The user-facing Timeline feature was removed in Windows 11, so the database may be absent or sparse on those systems and its presence should be checked rather than assumed.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That a named application was in use during a recorded interval, giving duration rather than a bare timestamp
- Which documents were open in that application, with paths, tying file access to a period of active use
- Per-user attribution, since the database is in the user's own local application data
- That activity occurred on a different device signed in to the same account, where sync was on — sometimes the only endpoint-side sign that a second machine existed
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- That the local machine performed the activity. Synced rows describe another device, and an examiner who does not separate local from synced activity may attribute a colleague's or a home machine's use to the computer in evidence
- That the database exists to be examined. Timeline was removed as a user-facing feature in Windows 11, and the database's presence and population vary by build and configuration
- Activity older than the retention window, which on Windows 10 is a rolling period of roughly a month rather than a durable archive
- That a person was at the machine for the whole recorded interval. An activity's duration measures the application's session, not attention
- That an absent activity means an application was not used. Participation in the mechanism is up to the application
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Separating synced rows from locally generated ones and showing the examiner conflated them
- Establishing the rolling retention window and showing the period at issue fell outside it
- Pointing out that the feature's removal in Windows 11 makes an empty database uninformative about behaviour
- Arguing that duration reflects a window being open rather than a user working
What survives, and for how long
Rows persist across reboots but are aged out on a rolling window measured in weeks on Windows 10. Clearing activity history removes them, and the database can be deleted outright by the user with no elevated rights.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What does the Windows ActivitiesCache database show?
It records which applications a user account had in use, over what interval, and which documents were open in them — giving duration rather than a bare timestamp, which is unusual among Windows artifacts. Where the user signed in with a Microsoft account and sync was enabled, it also contains activity performed on other devices signed in to the same account.
Does Windows 11 still have Timeline?
The user-facing Timeline feature was removed in Windows 11, so the activities database may be absent or sparsely populated on those systems. That makes it a Windows 10 artifact in practice. An examiner should establish the build and confirm whether the database exists and holds data before drawing any conclusion from its contents or from its emptiness.
Can Timeline data come from a different computer?
Yes, and it is the trap in this artifact. Where Microsoft account sync was enabled, activities performed on other devices signed in to the same account are written into the local database. Rows have to be separated by originating device before any of them are attributed to the machine in evidence, or a home laptop's use is reported as the work computer's.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
UserAssist
A per-user registry record of programs and shortcuts launched through the Windows graphical shell, with a run count, focus time, and the last execution time.
Jumplists
Per-application recent-file lists stored as compound files containing embedded LNK streams and an ordering list, recording which documents each program opened for a specific user.
LNK Shortcut Files
Shortcut files Windows creates when a document is opened through the shell, retaining the target's full path, its size and timestamps, and often the volume serial number of the drive it lived on.
KnowledgeC
A macOS database of user-activity streams recording which applications were in focus and for how long, when the display was lit, and when the device was locked.
Whether the windows timeline (activitiescache)evidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.