OneDrive needs no introduction, but the Personal Vault feature is still relatively unknown. In addition to the Timeline, the tool extracts Account Activities detailing the user’s sign-ins to their Microsoft account. This is where we extract it from: Elcomsoft Phone Breaker 9.70 downloads the data, and Elcomsoft Phone Viewer 5.30 displays its content in a convenient layout.īy analyzing the Timeline data, experts can access to timestamped information about the app usage and Web page visits.

If the user signs into their Microsoft account, Windows synchronizes the Timeline across devices. Along with Windows jumplists, the feature is little known and rarely disabled, giving a valuable insight into the history of system’s usage. The Timeline contains timestamped information about the user’s launched applications, searches, documents, and Web browsing history. The feature enhances Task View, enabling a glance into the past by displaying the user’s historical activities.

Windows Timeline is a feature that first appeared in the Windows 10 April 2018 Update. Learn about these data types and how they can help advance your investigation. In this new version, we have added support for even more types of data, including Windows 10 Timeline, Account Activity (logins to the account), OneDrive files, recent OneDrive files history, and files from Microsoft Personal Vault.

It can also download the data from other cloud services including Microsoft accounts. Elcomsoft Phone Breaker is not just about Apple iCloud data.

Microsoft personal vault