01Location
- C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\L.<user>\ActivitiesCache.db
02Questions it answers
- Which applications, files and URLs did a user interact with, and when?
- How long was an application in focus?
- Do records originate from another device linked to the same account (PlatformDeviceId)?
03Format and versions
| Format | SQLite database. User activity is held in the Activity, ActivityOperation and Activity_PackageId tables; Metadata, ManualSequence and (from 1809) DataEncryptionKeys are also present. AppId and Payload columns contain JSON. |
|---|---|
| Applies to | First observed on Windows 10 1803. Microsoft states activity history is stored locally; the option to send it to Microsoft was deprecated in Windows 11 22H2/23H2 with the January 2024 update. |
04Key fields
| Field | What it tells you |
|---|---|
| AppId | JSON array of platform/application identifiers. |
| Payload | JSON blob whose content varies by activity and platform type. |
| ActivityType | Research reading: 5 appears to be open app/file/URL and 6 app in focus. |
| StartTime / EndTime | Activity start and end; durations computed from them can differ from those in the JSON. |
| LastModifiedTime / ExpirationTime | Expiration observed as exactly 30 days after LastModified. |
| PlatformDeviceId | Device identifier that can be matched in the user's DeviceCache registry key. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| StartTime / EndTime / LastModifiedTime / ExpirationTime | Unix epoch seconds (UTC) | Stored in UTC according to the cited analysis. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy ActivitiesCache.db together with any companion files present in the folder.
- Query Activity and ActivityOperation, extracting fields from the AppId and Payload JSON.
- Convert epoch times to UTC and separate local from synced activity using PlatformDeviceId.
- Correlate with Jump Lists, LNK files and SRUM.
07Interpretation pitfalls
- ActivityType meanings come from independent research, not from Microsoft documentation.
- Users can turn off local storage of activity history or clear it in Settings.
- Entries expire about 30 days after last modification, limiting the look-back period.
09Sources
- Activities Cache Database ForensicArtifacts / artifacts-kb · checked 2026-10-14
- Windows activity history and your privacy Microsoft Support · checked 2026-10-14
- An examination of Win10 ActivitiesCache.db database kacos2000 (GitHub Pages) · checked 2026-10-14
- WxTCmd README Eric Zimmerman (GitHub) · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14