Windows 10 Timeline

Description: Win10 records recently used applications and files in a “timeline” accessible via the “WIN+TAB” key. The data is recorded in a SQLite database.

Location:

• C:\Users\<username>\AppData\Local\ConnectedDevicesPlatform\L.\ActivitiesCache.db

Notes:

• Application execution
• Focus count per application

Analysis:
Coming Soon!