Remember Windows Timeline? No… noone does.
Windows timeline keeps a record of historical and recently used files and applications. The feature was introduced in the early versions of Windows 10 and was nerfed later on.
As forensic investigators we can use it’s database to answers questions like what appliacations a user has accessed, opened, executed.
Although Timeline is no longer in use its not completely gone. Timeline saves its data in a file called ActivitiesCache.db located in a users %AppData% under the //local/ConnectedDevicesPlatform directory.
WxTcmd is a tool developed by Eric Zimmerman. The tool parses the ActivitiesCache.db and produces a .csv file as output with a record of recently used appliactions/files.
