Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Windows timeline
Windows timeline history viewer
01.03.2024
New blog post
Dumping the history of users' IP addresses in Windows
20.02.2024
Reset Windows Password v14.1
IP addresses history viewer, fast disk search, local security editor and some more
02.01.2024
Wireless Password Recovery v6.9.0
A revision of the GPU health monitor along with some minor updates
23.12.2023
HAPPY NEW YEAR!
Happy New Year greetings and holidays discount

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: Windows activity timeline


The timeline is a comparatively new function of Windows 10 that is first introduced with version 1803. It shows your past activities and things you were working on earlier. Such as the applications you opened, the files you used, the websites you browsed, etc. In Windows 10, you can manage your timeline activity history in Start -> Settings -> Privacy -> Activity history. If you want to stop Windows collecting your activity, just clear the check-box next to the ‘Show my activity history on this device’.

The \AppData\Local\ConnectedDevicesPlatform directory is a home to multiple CPDS files. А CPDS file most likely stands for Connected Platform Device Settings. This is a JSON-format file containing settings for managing the Timeline profile. Apart from the general settings, the above directory holds up to three .cpds files corresponding to the local account, domain, or Microsoft account of the user profile.

Windows 10 Timeline stores user activity in ‘ActivitiesCache.db’ file, which, in fact, is an SQLite database. You can find the database at the following location:
\AppData\Local\ConnectedDevicesPlatform\\ActivitiesCache.db

Almost all information related to the user activity incorporated into two tables: Activity_PackageId and Activity. By default, the data records live for 30 days until they are marked as deleted.

Reset Windows Password allows you to display the user activity data stored by the Windows timeline for any user in a human-readable form. It also extracts some additional information, such as what program a certain user was working on and how long, the documents he/she was opening from within the application, active and total usage time, active device, etc.

It is much easier to use the Windows activity timeline feature rather than analyzing the data manually. The 3-step workflow process guides you to select the initial user account, set up additional time filters and display the user activity timeline. Simple as 1-2-3.

 

Selecting a Windows timeline account

Selecting Windows timeline user account

Select the user on which activity history you need to view. By default, all users.


 

Setting activity timeline display filters

Setting Windows timeline filters

You can set up additional time filters to skip showing unnecessary activities.
 


Windows activity timeline

Windows timeline


The Excel-like table allows displaying the data most conveniently. You can sort the table by clicking a column header. If you need to skip some unnecessary items, just start typing something into the filter box right below the column header. The program supports multiple filters simultaneously.

Here is a brief description of what information every table's column holds.

Application - a short text description of the application used to generate the user activity
Document name - a file that was opened/edited within the application
Activity type - a type of operation. For example: sending a notification, authentication, opening application/file/URL, using application/file/URL, clipboard copy/paste, system operation.
Activity started - initial time the activity began
Activity ended - when the activity finished
Active usage - how much time (in seconds) the application was focused and used intensively
Total usage - how much time (in seconds) the application used in total
Application path - full path to the application
Document location - full path to the document (that was opened/edited from within the application)
Parent application - parent application for current user activity. For example, for a clipboard paste operation, this is an application where the data was copied from.
Source host - URL address representing the cross-platform identity mapping for the application
Clipboard content - content of the Windows clipboard buffer. Only if the Activity type is Clipboard content.
User - the name of the user. Note that one user profile may hold 3 Account types. Thus, this column may contain up to 3 different names for a single user profile.
Account type - the type of the user: local, domain or Microsoft account
User status - shows if the user is engaged with the application
User timezone - the time zone in which the device used to generate the activity was located at activity start time
Device - a name of the device (including its model, type and manufacture) used to generate the user activity
Status - a status code used to identify the activity object: active, updated, deleted or ignored