Oh, Behave! Figuring Out User Behavior

This report analyzes the Windows Timeline artifact (ActivitiesCache.db) and demonstrates how to extract, decode, and visualize user activity on Windows (application usage, launch times/parameters, first/last daily timestamps, and activity heatmaps). The author references existing tools and their own Python-based reporting, emphasizes the artifact's value for behavioral insight, and notes that the technique could be repurposed offensively while presenting it as research.