timeline-activities

Parses the ActivitiesCache.db file from Windows 10 to retrieve Timeline activity history. This file contains activity records such as programs executed by the user, documents opened, and web pages visited.

Command properties

Property	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

timeline-activities FILE_PATH

Target

FILE_PATH: Path to the ActivitiesCache.db file to query. On Windows 10, this file is located inside the C:\Users\<username>\AppData\Local\ConnectedDevicesPlatform directory.

Output fields

Field	Type	Description
`id`	binary	Unique activity identifier
`executable`	string	Executable file path. Extracted from the first element of the AppId JSON array (e.g., `{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\cmd.exe`)
`activity_type`	string	Activity type. `ExecuteOpen` (5): program execution, `InFocus` (6): focus activation, `CopyPaste` (16): clipboard copy/paste
`payload_app_display_name`	string	App display name (e.g., `Command Prompt`)
`payload_display_text`	string	Activity display text
`payload_description`	string	Activity description
`payload_active_duration`	integer	Active duration (seconds)
`start_time`	timestamp	Activity start time
`end_time`	timestamp	Activity end time. Returns null if the activity has not ended.
`last_modified_time`	timestamp	Last modified time
`last_modified_on_client`	timestamp	Last modified time on the client
`expiration_time`	timestamp	Expiration time
`priority`	integer	Priority
`activity_status`	integer	Activity status
`user_action_state`	integer	User action state
`created_in_cloud`	integer	Whether the activity was created in the cloud
`is_read`	integer	Whether the activity has been read
`is_local_only`	integer	Whether the activity is local-only
`etag`	integer	ETag value
`group_app_activity_id`	string	Group app activity identifier
`app_activity_id`	string	App activity identifier
`parent_activity_id`	binary	Parent activity identifier
`package_id_hash`	string	Package ID hash
`platform_device_id`	string	Platform device identifier
`payload_activation_uri`	string	Activation URI
`payload_background_color`	string	Background color
`payload_content_uri`	string	Content URI
`payload_type`	string	Payload type
`payload_user_timezone`	string	User time zone
`payload_reporting_app`	string	Reporting app
`clipboard_payload`	string	Clipboard payload
`tag`	string	Tag

Error codes

Parsing errors

N/A

Runtime errors

N/A

Description

The timeline-activities command opens the specified ActivitiesCache.db file as a SQLite database and retrieves records from the Activity table. The Windows 10 Timeline records activities performed by the user, such as program execution, document opening, and web browsing.

The AppId column is stored in JSON array format. The command extracts the executable file path from the application field of the first element and assigns it to the executable field. The ActivityType column's integer values are converted to meaningful strings. The Payload column is stored in JSON format, and details such as app display name, display text, and active duration are separated into individual fields.

Date fields are converted from Unix timestamps (in seconds) to timestamp type. If end_time is 0, null is assigned.

This command does not support querying files inside a ZIP archive.

Examples

Query an ActivitiesCache.db file
```
timeline-activities /opt/logpresso/evidence/ActivitiesCache.db
```
Retrieves all Timeline activities from the ActivitiesCache.db file at the specified path.

Filter program execution history

timeline-activities /opt/logpresso/evidence/ActivitiesCache.db
| search activity_type == "ExecuteOpen"

Filters for activities of the program execution (ExecuteOpen) type only.

Retrieve activities for a specific period

timeline-activities /opt/logpresso/evidence/ActivitiesCache.db
| search start_time >= date("2025-01-01", "yyyy-MM-dd")
| sort start_time

Retrieves activities that occurred on or after January 1, 2025, sorted by start time.