Observed arrival · 2026-09-28
A browser-side reader for Windows Timeline evidence
A browser tool for parsing Windows Timeline databases to inspect app use, opened files, window focus time, and clipboard history.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- DFIR investigators and Windows incident responders
- Worth noticing
- The guide warns that recent activity may exist only in the -wal file; its sample database is synthetic.
Field notes
The guide walks through collecting the database and WAL file from Windows profiles, including a PowerShell method that creates a shadow copy before copying both files. It also describes accepting KAPE output and Velociraptor collection ZIPs, so investigators can bring data from existing triage workflows. The included example is explicitly synthetic and fictional.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue