Clipboard Payloads via ActivitiesCache.db

This artifact is only generated where both “Clipboard History” and “Clipboard history across your devices” is enabled within the Windows system settings for clipboard.

ActivitiesCache.db is associated with the Windows Timeline feature, which was introduced in Windows 10, allowing users to keep track of their activities across different devices and sessions.

This artifact is located in:

C:\Users\Username\%AppData%\Local\ConnectedDevicesPlatform\<UserProfile>\
 

This .db file can be opened using appropriate software, such as DB Browser for SQLite. The ActivityOperations table is of interest, with the following notable fields:

• StartTime (epoch time) – When the data was first copied to the clipboard 
• ExpirationTime (epoch time) – When the data will be deleted from the ActivitiesCache.db (roughly 12 hours) 
• ClipboardPayload – Base64 encoded string of the clipboard contents  
• Payload – This field tells you where the clipboard data was copied from
• ActivityType – Type 10 means data resides in clipboard, Type 16 shows if data was copied or pasted