WindowsTimeline parser (x64)

• Added Hex Offset in the Clipboard text carver
• Added column with Clipboard Type info (in anticipation of upcoming Clipboard change)
• Updated estimation of Win10 version identification (based on the dB)
• Changed 1703/1709 queries to show more data
  (Win10 v1709 and earlier have the following line in the Smartlookup View query preventing display of deleted entries:)
  LEFT OUTER JOIN Activity ON ActivityOperation.Id = Activity.Id WHERE [O].[OperationType] <> 3

WindowsTimeline parser (x64)

• Changed the queries so that all timestamps are (as they should be) in UTC
• Updated IANA/OLSON TimeZone support (does not account for Daylight savings)
• Included 'Clipboard Text Carver' option

NOTE: In previous 'WindowsTimeline parser' versions timestamps are in examiner's Local Time

WindowsTimeline Clipboard Text Carver (Win10 x64)

Update :
- Added tooltips
- Changed Base64 conversion from ASCII to UTF8.

WindowsTimeline parser (x64)

• Minor GUI scaling & file output fixes

WindowsTimeline Clipboard Text Carver (Win10 x64)

- Retrieves (carves) current & deleted Clipboard text entries from an ActivitiesCache db or db-wal file.
- Displays offset of entry in the file & decoded text
- Allows Copy of a selection or all of the results
- Allows export to "|" separated CSV

          Example:
           - WindowsTimeline.exe: 15 clipboard text entries (SQLite query)
           - ClipboardTextEntries.exe: 224 from the db & 19 from the db-wal

WindowsTimeline parser (x64)

• Quite a few updates/improvements, plus:

  • Show estimation of originating Win10 version in the status bar while processing
  • Added GMT representation of the Timezone (based on Olson/IANA lists) (does not account for Daylight savings)
  • Added option to view Clipboard history (if available) in a separate window
  • Added option to export Clipboard history (if available) separately in a CSV

WindowsTimeline parser (x64)

• Added support for all ActivitiesCache.dbs (from 1709-2004+)
  done limited testing on 1709 dbs due to the scarcity of them
• Added some column info tooltips
• Many small improvements

WindowsTimeline parser (x64)

• Minor fix

WindowsTimeline parser (x64)

• Added support for 'ActivityEngagementFlags' in ActivityType 6 entries (Win10 v.2004+)
• Fixed error not displaying ParentActivityId

WindowsTimeline parser (x64)

Added support for Device Type 16 (Windows 10 Tablet PC)
Added option to view All the Devices in the selected NTUser.dat in a popup
Added some coloring to ease viewing large dB sets

Note:
If you need/want to manually download "System.Data.SQLite"
the location of the downloads is https://system.data.sqlite.org/index.html/doc/trunk/www/downloads.wiki

WindowsTimeline.exe looks for this file:
"C:\Program Files\System.Data.SQLite\2010\bin\System.Data.SQLite.dll"