WxTCmd version 0.6.0.0
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/WxTCmd
f File to process. Required
csv Directory to save CSV formatted results to. Be sure to include the full path in double quotes
dt The custom date/time format to use when displaying timestamps. See https://goo.gl/CNVq0k for options. Default is: yyyy-MM-dd HH:mm:ss
Examples: WxTCmd.exe -f "C:\Users\eric\AppData\Local\ConnectedDevicesPlatform\L.eric\ActivitiesCache.db" --csv c:\temp
Database files are typically found at 'C:\Users\<profile>\AppData\Local\ConnectedDevicesPlatform\L.<profile>\ActivitiesCache.db'
Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes
WxTCmd is a parser for the Windows 10 Timeline feature database.
All of Eric Zimmerman's tools can be downloaded here.
Open Source Development funding and support provided by the following contributors: SANS Institute and SANS DFIR.