Amcache

Amcache is a vital Windows artifact that tracks installed applications, executed programs, and loaded drivers, among other elements. Its unique capability to record the SHA1 hash of executables and drivers makes it an invaluable resource for forensic investigations. This artifact is present in Windows 7 and later versions, located at C:\Windows\AppCompat\Programs\Amcache.hve. It serves as a complete registry hive, containing multiple sub-keys that store comprehensive details about files, such as their full path, size, modification and compilation times, and publisher metadata.

Key Insights:

• Location: C:\Windows\AppCompat\Programs\Amcache.hve

• Critical Information:

  • Tracks SHA1 hashes of executables and drivers.

  • Stores details on installed applications and loaded drivers.

  • Includes information on unassociated executables.

  • Records file paths, sizes, modification and compilation times, and publisher data.

• Relevance: Amcache provides evidence of the presence of executables and drivers on a system. However, it should not be solely relied upon to prove execution, as entries may result from automated file discovery or installation processes.

Overview:

Amcache.hve is a comprehensive registry hive that plays a crucial role in forensic investigations. It aggregates data about software and driver installations, executions, and other system interactions. This artifact not only aids in identifying what was present on a system but also offers insights into the origin and integrity of files through its hash value records.

Practical Use Case:

A forensic analyst investigating a breach might examine the Amcache.hve file to determine if any known malicious executables or drivers were present on the system. By comparing the SHA1 hashes recorded in Amcache with known bad hashes, analysts can identify potential threats.

Manual Examination:

1. Accessing Amcache.hve:

   • Use the command line to navigate to its directory:

     cd C:\Windows\AppCompat\Programs\

   • Utilize a registry editor or forensic tool to open the Amcache.hve file.

2. Analyzing the Contents:

   • Look for entries under the sub-keys that relate to installed applications, executed programs, and loaded drivers.

   • Pay special attention to the SHA1 hash values for executables and drivers, comparing them with known databases for verification.

Open Source Tools:

• RegRipper: An open-source tool for registry analysis that can parse Amcache.hve files, extracting and presenting the data in an easily understandable format.

• AmcacheParser: Specifically designed to analyze Amcache.hve files, this tool can extract detailed information, including file paths, hashes, and timestamps.