> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/program-execution/amcache.md). # Amcache Amcache is a Windows registry hive that tracks applications, executables, drivers, and shortcuts that have been discovered or interacted with on the system. It records SHA1 hashes, file paths, compilation timestamps, and publisher metadata, making it one of the most useful artifacts for forensic investigations. Amcache was introduced in Windows 8, replacing the `RecentFileCache.bcf` file used in Windows 7. ### Location ``` C:\Windows\AppCompat\Programs\Amcache.hve ``` Transaction log files (`.LOG1`, `.LOG2`) are located in the same directory and should be collected alongside the hive to ensure a complete and consistent parse. Dirty hives without their transaction logs may contain incomplete data. ### Key Forensic Caveat: Amcache Does Not Prove Execution An entry in Amcache does **not** by itself prove that a program was executed. Entries can be created through several mechanisms: * Application installation (MSI, setup executables). * The Microsoft Compatibility Appraiser scanning the file system for known applications. * File discovery during automated inventory scans. * Shimming of an application during execution. To establish execution with higher confidence, correlate Amcache entries with [**Prefetch**](/windows-artifacts/folder-file-opening-creation/prefetch.md), [**BAM/DAM**](/windows-artifacts/program-execution/bam-dam.md), [**UserAssist**](/windows-artifacts/program-execution/userassist.md), **PCA** (Windows 11 22H2+), or **process creation event logs** (Sysmon Event ID 1 / [Security Event ID 4688](/windows-artifacts/event-ids/security/file-system/4688-process-created.md)). If a file appears in both Amcache *and* Prefetch, confidence of execution is high. ### Hive Structure The Amcache.hve hive contains multiple root keys. The structure has evolved across Windows versions. Older versions used a `Root\File` key, while modern versions (Windows 10 build 14913+ onward) use `InventoryApplicationFile` and related keys. The most forensically relevant keys are outlined below. #### InventoryApplicationFile This is the primary key for tracking executables discovered on the system. Each subkey is named using the format `filename.exe|hash_fragment` and contains: | Value | Description | | ------------------- | --------------------------------------------------------------------------------- | | `LowerCaseLongPath` | Full file path of the executable | | `FileId` | SHA1 hash of the first 31,457,280 bytes (30 MB) of the file, prefixed with `0000` | | `Size` | File size in bytes | | `LinkDate` | PE compilation timestamp (from the PE header, not a file system timestamp) | | `BinaryType` | Architecture: `pe32_i386` (x86) or `pe32_amd64` (x64) | | `Publisher` | Publisher name from the file's version information | | `ProductName` | Product name from version info | | `ProductVersion` | Version string | | `ProgramId` | Links this entry to a corresponding `InventoryApplication` entry | | `Language` | Language code from version info | #### InventoryApplication Tracks installed applications (those with an Uninstall key or MSI registration). Each subkey is named by the application's `ProgramId`, linking it to entries in `InventoryApplicationFile`. This key contains a **`LastScanTime`** value (in Windows FILETIME format) that corresponds to the last time the **Microsoft Compatibility Appraiser** scheduled task ran. This is critical: > **If the Compatibility Appraiser task has not run recently, InventoryApplication data may be stale or incomplete.** Check `Task Scheduler > Microsoft > Windows > Application Experience > Microsoft Compatibility Appraiser` to verify the task's status and last run time. If this task has been disabled (common in some hardened environments), Amcache inventory data may be incomplete. Key values include: | Value | Description | | ----------------- | ------------------------------------------------------------------- | | `Name` | Application display name | | `Version` | Application version | | `Publisher` | Publisher name | | `InstallDate` | Installation date (day-level granularity only) | | `Source` | How the application was installed (`AddRemoveProgram`, `Msi`, etc.) | | `UninstallString` | Uninstall command path | | `RootDirPath` | Application root directory | #### InventoryDriverBinary Records information about loaded drivers, including file path, SHA1 hash, digital signature details, and modification timestamps. This key is relevant when investigating rootkits, malicious drivers, or BYOVD (Bring Your Own Vulnerable Driver) attacks. #### InventoryApplicationShortcut Records shortcut (.lnk) files associated with installed applications. The last write timestamp of each subkey provides a general indicator of when the shortcut was created or modified. #### Legacy: Root\File Key On older systems (pre-Windows 10 build 14913), executable data was stored under the `Root\File` key rather than `InventoryApplicationFile`. The subkey naming convention and available fields differ. Eric Zimmerman's AmcacheParser handles both formats automatically. ### SHA1 Hash Details The SHA1 hash stored in Amcache has specific characteristics: * The hash covers only the **first 30 MB** (31,457,280 bytes) of the file. For files smaller than 30 MB, the entire file is hashed. For files larger than 30 MB, only the first 30 MB is used, meaning the hash may not match a full-file SHA1 computed by other tools or VirusTotal. * The `FileId` value stores the hash with a `0000` prefix (e.g., `0000abcdef1234567890...`). Strip the leading four zeros to get the actual SHA1. * Amcache does **not** record hashes for all file types. It primarily covers executables (.exe, .dll) and drivers (.sys). ### Practical Analysis Workflow 1. **Collect the hive:** Copy `Amcache.hve`, `.LOG1`, and `.LOG2` from `C:\Windows\AppCompat\Programs\`. Use KAPE, Velociraptor, or raw disk imaging. The hive is locked on a live system, so use a tool that can handle locked files (raw copy, VSS, or forensic agent). 2. **Parse with** [**AmcacheParser**](https://github.com/EricZimmerman/AmcacheParser)**:** ``` AmcacheParser.exe -f Amcache.hve --csv C:\output\ --csvf amcache_results.csv ``` AmcacheParser produces separate output files for each key type: `AssociatedFileEntries` (files linked to installed applications), `UnassociatedFileEntries` (standalone executables), `DeviceContainers`, `DriverBinaries`, `ShortCuts`, etc. 3. **Check the Appraiser status:** Review the `LastScanTime` value in the `InventoryApplication` key to understand how current the data is. If the Appraiser hasn't run recently, recently installed software may not appear. 4. **Cross-reference hashes:** Extract SHA1 hashes (strip the `0000` prefix from `FileId`) and compare against threat intelligence feeds, VirusTotal, or internal IOC lists. Even after a malicious file is deleted, its hash persists in the hive. 5. **Correlate ProgramIds:** Use the `ProgramId` value to link individual executables (`InventoryApplicationFile`) back to their parent application (`InventoryApplication`). This helps distinguish between files belonging to legitimate installed software and standalone suspicious executables. 6. **Timeline integration:** The `LinkDate` (PE compilation timestamp) and subkey last write times can be incorporated into a Super Timeline for temporal analysis. ### Artifact Correlation * **Prefetch:** If a file appears in both Amcache and Prefetch, execution confidence is high. Prefetch provides execution timestamps that Amcache lacks. * **ShimCache:** Confirms file presence on the system. On Windows 10/11, ShimCache can no longer prove execution, but the combination of ShimCache + Amcache strengthens evidence that a file was present. * **PCA (Windows 11 22H2+):** The `PcaAppLaunchDic.txt` file provides execution timestamps with full file paths. PCA's `ProgramId` field can be correlated directly with Amcache entries. * **BAM/DAM:** Background Activity Moderator provides execution evidence with timestamps. * **SRUM:** System Resource Usage Monitor records per-application resource usage and can corroborate execution. * **$MFT / $UsnJrnl:** Provides file creation and modification timestamps to complement Amcache's data about file presence. ### Tools * [**AmcacheParser**](https://github.com/EricZimmerman/AmcacheParser) **(Eric Zimmerman):** The standard tool for parsing Amcache.hve. Supports both legacy (`File`) and modern (`InventoryApplicationFile`) key formats. Outputs to CSV or JSON. * [**Registry Explorer**](https://github.com/EricZimmerman/RegistryExplorer) **(Eric Zimmerman):** Manually browse the Amcache hive structure for targeted analysis. * [**RegRipper**](https://github.com/keydet89/RegRipper3.0)**:** The `amcache` plugin extracts and formats Amcache data. Useful for quick triage. * [**KAPE**](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)**:** Targets for collecting Amcache.hve and modules for parsing with AmcacheParser in a single workflow. * [**Velociraptor**](https://docs.velociraptor.app/)**:** The `Windows.Forensics.Amcache` artifact collects and parses Amcache data at scale across endpoints. * [**Regipy**](https://github.com/mkorman90/regipy) **(Python):** Open-source registry parser for scripting and automation of Amcache analysis. ### Anti-Forensics Considerations * **File deletion does not remove Amcache entries.** Even after the original executable is deleted, its path, hash, and metadata persist in the Amcache hive. * **Hive deletion/corruption:** An attacker with administrator privileges could delete or corrupt the Amcache.hve file, though this is relatively uncommon and would itself be suspicious. * **Appraiser task manipulation:** Disabling the Compatibility Appraiser scheduled task prevents new inventory data from being written to the `InventoryApplication` key, but `InventoryApplicationFile` may still be populated through other mechanisms. * **VSS awareness:** Previous versions of Amcache.hve may be recoverable from Volume Shadow Copies, providing historical snapshots of the hive. ### References * [Kaspersky Securelist: AmCache artifact - forensic value and a tool for data extraction](https://securelist.com/amcache-forensic-artifact/117622/) * [Psmths: Windows Forensic Artifacts - Amcache](https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/amcache.md) * [Magnet Forensics: ShimCache vs AmCache](https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/) * [Eric Zimmerman's AmcacheParser](https://github.com/EricZimmerman/AmcacheParser)