Full Report
How Windows 10 Timeline Can Help Forensic Experts
Analysis Summary
# Tool/Technique: Windows 10 Timeline Analysis (ActivitiesCache.db)
## Overview
Windows 10 Timeline is a built-in operating system feature designed to allow users to resume past activities across devices. For forensic analysts, it serves as a high-value artifact stored in a SQLite database (**ActivitiesCache.db**). It records a chronological history of user actions, including application execution, file access, and website visits, providing a "time-machine" view of system activity.
## Technical Details
- **Type**: Forensic Technique / OS Artifact
- **Platform**: Windows 10 (Version 1803 and later)
- **Capabilities**: Tracks application usage, file openings, URI links, and clipboard history for up to 30 days (local) or longer (cloud-synced).
- **First Seen**: Introduced in Windows 10 "April 2018 Update" (Version 1803).
## MITRE ATT&CK Mapping
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]: Used by analysts to see what files were accessed by attackers.
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]: Timeline logs when a user or attacker executes a malicious binary.
- **[TA0009 - Collection]**
- [T1115 - Clipboard Data]: Windows Timeline can store clipboard history, which may contain sensitive data collected by attackers.
## Functionality
### Core Capabilities
- **Activity Recording**: Logs the AppID (Path to executable), Start/End times, and duration of activity.
- **File Interaction**: Records which files were opened within specific applications (e.g., a document opened in Notepad).
- **Persistence of Deleted Data**: Even if a malicious tool or file is deleted from the disk, the record of its execution remains in the `ActivitiesCache.db`.
### Advanced Features
- **Cross-Device Sync**: If enabled, the timeline can show activities performed on other devices linked to the same Microsoft account.
- **Deep Linking**: Stores specific URIs or shell links, allowing analysts to see the exact context of an application's use.
## Indicators of Compromise
- **File Names**: `ActivitiesCache.db`, `ActivitiesCache.db-shm`, `ActivitiesCache.db-wal`.
- **Registry Keys**: `HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager` (related to activity settings).
- **Behavioral Indicators**:
- Execution of known lateral movement tools (e.g., `TeamViewer.exe`).
- Execution of credential dumping tools (e.g., `mimikatz.exe`).
- Modification of log files via text editors (e.g., opening `TeamViewer14_Logfile.log` in `notepad.exe` to alter traces).
- Downloads from file-sharing sites (e.g., `sendspace[.]com`) recorded in browser activity.
## Associated Threat Actors
- This is a general forensic technique; however, the article highlights its use in detecting attackers who utilize:
- **Remote Access Tools**: TeamViewer.
- **Credential Harvesters**: Mimikatz.
## Detection Methods
- **Database Analysis**: Extracting the SQLite database from `%AppData%\Local\ConnectedDevicesPlatform\{User_SID}\ActivitiesCache.db`.
- **Forensic Tools**:
- **WxTCmd**: Command-line parser for ActivitiesCache.db.
- **Magnet AXIOM**: Automated artifact extraction and visualization.
- **Belkasoft Evidence Center**: Comprehensive system file analysis including Windows Timeline category.
- **DB Browser for SQLite**: Manual inspection of the `Activity` and `Activity_Payload` tables.
## Mitigation Strategies
- **Privacy Settings**: Disable "Store my activity history on this device" and "Send my activity history to Microsoft" via Group Policy or Settings.
- **Data Retention**: Regularly clear activity history or use CCleaner/scripting to purge the `ConnectedDevicesPlatform` folder.
- **Endpoint Hardening**: Restrict the use of unauthorized remote access tools and implement AppLocker/Windows Defender Application Control (WDAC).
## Related Tools/Techniques
- **UserAssist**: Registry keys tracking GUI-based application execution.
- **Prefetch/Superfetch**: Artifacts tracking application launch frequency and timing.
- **Shimcache (AppCompatCache)**: Tracks executable files to identify compatibility issues, often used to prove file existence.
- **ShellBags**: Tracks folder access history.