NOW AVAILABLE: Cellebrite Premium packaged to fit varying agency needs. Learn more
Webinar  |  On Demand

Windows 10 Activity Timeline: An Investigator’s Gold Mine

Ask the Expert - UFED Physical Analyzer
Thank you for submitting the form.
Your webinar is now available.

With the release of Windows 10 version 1803, came an exciting new forensics artifact: The Activity Timeline.

The Activity Timeline is designed to remind users what they were up to in the recent past and help them pick up those activities right where they left off – even across multiple devices.

In order to accomplish this feat, Windows stores a wealth of forensic goodness in a per-user SQLite database.

Among the items tracked in the new Activity Timeline are when users open and close apps, actual engagement times, and the files the user was interacting with through the app. These key items tracked are of significant value to forensics practitioners and can make or break a case.

In this on-demand webinar, Dr. Vico Marziale, Senior Digital Forensics Researcher at BlackBag, will walk investigators through:

  • Configuration options for the Timeline
  • How to find these databases
  • How to decipher the contents of the database

Follow along and you’ll have a shiny new tool in your forensics arsenal just waiting to be utilized in your next engagement.


Cellebrite is proud to welcome BlackBag Technologies to our family – bringing industry-leading computer access and analysis tools to our Digital Intelligence Solution suite.