Uncovering Digital Evidence through Timeline Artifact Analysis in Windows OS Systems

With the rapid advancement of technology and the evolution of Cyber Security threats, investigators often struggle to keep pace with the increasing complexity of data collection and analysis.As operating systems undergo frequent updates, the structure and accessibility of key forensic artifacts continuously change, complicating the reconstruction of user activity.Forensic artifacts serve as critical sources of evidence, capturing various aspects of system activity and user interactions.Among them, the Timeline artifact in Windows OS plays a crucial role by collecting and organizing user activity details in a structured database format known as ActivitiesCache.db.This database maintains records of timestamps, application usage, file access, and system interactions, providing valuable insights for forensic investigations.This paper highlights the significance of analyzing the timeline artifact.Unlike registry entries and event logs, timeline artifact analysis offers a more comprehensive and structured representation of system activities, ensuring faster and more efficient forensic investigations.