- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
One unified chronology of everything that happened on a Windows computer — files, logons, programs, USB, browsing, network, and system state — normalized to the second and exportable as a court exhibit.
Quick Answer. A Windows super-timeline merges timestamps from every relevant artifact — $MFT, $UsnJrnl, LNK, Prefetch, Amcache, Shimcache, SRUM, UserAssist, browser history, Security/System/PowerShell EVTX, RDP logs, USBSTOR, and the Windows 10/11 ActivitiesCache.db — into a single time-ordered exhibit. Each row carries its source artifact, its native and UTC timestamps, the user SID when available, and a plain-English description. Timelines survive Daubert scrutiny because each row is directly traceable to an on-disk artifact whose parser and byte offset are documented.
| Category | Artifacts contributed | Typical entries per case |
|---|---|---|
| File system | $MFT SI + FN, $UsnJrnl, $LogFile, Recycle Bin | Hundreds of thousands to millions |
| Program execution | Prefetch, Amcache, Shimcache, BAM/DAM, UserAssist, MUICache | Thousands |
| Windows event logs | Security, System, Application, PowerShell, TerminalServices, Sysmon | Tens to hundreds of thousands |
| Registry | Run keys, USBSTOR, MountedDevices, NetworkList, TypedPaths | Hundreds |
| Browser | Chromium/Firefox visits, downloads, searches, cache | Thousands to millions |
| Windows Timeline (10) | ActivitiesCache.db per-user activities | Thousands |
| System state | Volume Shadow Copies, hibernation, pagefile timestamps | Dozens |
Windows 10 introduced a per-user activity database at %LOCALAPPDATA%\ConnectedDevicesPlatform\L.<user>\ActivitiesCache.db. This SQLite database logs application launches and file open events with app IDs, target file URIs, start and end timestamps, and duration — sometimes for weeks. Even where Microsoft has deprecated the Timeline UI in later builds, the ActivitiesCache.db often continues to populate and remains one of the richest per-user activity sources on Windows 10 endpoints.
SYSTEM\CurrentControlSet\Control\TimeZoneInformation gives the applicable zone at acquisition.Every row: UTC timestamp | Local timestamp | Source artifact | Byte offset / row ID | User SID | Description | Corroborating artifacts. Reports are trimmed to the relevant window and paginated with a per-day summary. See related pages for the individual artifact deep-dives: event logs, file activity, program execution.
Elite Digital Forensics is an independent, defense-aligned Windows forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Windows Forensics hub for the full analytical framework we bring to every matter.
A single busy Windows workstation over a 90-day window regularly produces one to five million timeline rows before filtering. The reported exhibit is usually a few hundred to a few thousand rows in the relevant window.
Yes. Uncorroborated entries are labeled as such. Findings that drive the case are always tied to two or more independent artifact sources.
Yes, but not preferred. Live collection introduces write activity that can perturb $UsnJrnl, Amcache, and Prefetch. Where a live triage is unavoidable, we document the tools and their expected footprint.
AV logs are one input among many. Timeline output includes the underlying operating-system evidence — MFT, USN, EVTX, registry — that AV logs summarize but do not replace.
Tell us about the computer, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder