Clipboard History
Overview
Section titled “Overview”Evidence: Clipboard History
Description: Parse Clipboard History from ActivitiesCache.db
Category: System
Platform: windows
Short Name: clphst
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”Windows Clipboard History stores clipboard entries in ActivitiesCache.db when Clipboard History is enabled (Windows 10 1809 and later). This is distinct from the live Clipboard collector, which captures current clipboard contents. History records reveal copied text and copy or paste operations across applications over time.
Data Collected
Section titled “Data Collected”This collector gathers structured clipboard history and copy/paste activity, including content, content format, source application, timestamps, and related activity identifiers. Results are recorded in clipboard_history and clipboard_activity.
Collection Method
Section titled “Collection Method”This collector copies ActivitiesCache.db from user profiles, queries clipboard entries, decodes clipboard payloads, and records structured fields. Companion database files are collected with the parsed results.
Forensic Value
Section titled “Forensic Value”Clipboard history can reveal sensitive data that users copied, including passwords, credentials, and confidential text. Copy and paste tracking shows data movement between applications, which is critical for data exfiltration investigations.