WindowsTimeline Clipboard Text Carver (Win10 x64)
- Retrieves (carves) current & deleted Clipboard text entries from an ActivitiesCache db or db-wal file.
- Displays offset of entry in the file & decoded text
- Allows Copy of a selection or all of the results
- Allows export to "|" separated CSV
Example:
- WindowsTimeline.exe: 15 clipboard text entries (SQLite query)
- ClipboardTextEntries.exe: 224 from the db & 19 from the db-wal
Update :
- Minor GUI fixes (e.g. dpi scaling)
Note: Duplicate entries could indicate that the clipboard text was in both 'Payload' & 'ClipboardPayload' fields.
Typically this occurs in synced entries, but this is not confirmed 100%.