Windows 10 Activity Timeline: An Investigator’s Gold Mine

With the release of Windows 10 version 1803, came an exciting new forensics artifact: The Activity Timeline.

The Activity Timeline is designed to remind users what they were up to in the recent past and help them pick up those activities right where they left off – even across multiple devices.

In order to accomplish this feat, Windows stores a wealth of forensic goodness in a per-user SQLite database.

Among the items tracked in the new Activity Timeline are when users open and close apps, actual engagement times, and the files the user was interacting with through the app. These key items tracked are of significant value to forensics practitioners and can make or break a case.

In this on-demand webinar, Dr. Vico Marziale, Senior Digital Forensics Researcher at BlackBag, will walk investigators through:

• Configuration options for the Timeline
• How to find these databases
• How to decipher the contents of the database

Follow along and you’ll have a shiny new tool in your forensics arsenal just waiting to be utilized in your next engagement.