Forensic Friday – Whats in your Timeline?

A forensic look at Windows 10 Timeline

In 2018 Windows 10 introduced a new feature named “Timeline” which has seen enhancements in subsequent updates to the Operating System in 2018 ~ 2020.  This feature acts like a browser for all your recent file and web interactions on the local computer as well as mobile devices and if enabled your additional trusted devices too.  It provides a chronological view of software interactions, which not only contains the websites visited but all documents edited, the pictures you viewed as well as information of which machine it was interacted with last, most importantly the amount of time the user interacted with the item.

During this session we will take a deep dive into the artifacts this feature creates and how they may be used by the system and interpreted in a forensic examination.  Attendees will gain a deeper understanding of the complexities of this feature and a first-hand look at the SQLite database containing all the artifacts while gaining an understanding of the cloud-based synchronization issues.  Attendees will be exposed to advanced SQLite queries to interpret the data into a more human readable format.

Cost: Complementary