Amcache

Amcache is a Windows registry hive that tracks applications, executables, drivers, and shortcuts that have been discovered or interacted with on the system. It records SHA1 hashes, file paths, compilation timestamps, and publisher metadata, making it one of the most useful artifacts for forensic investigations. Amcache was introduced in Windows 8, replacing the RecentFileCache.bcf file used in Windows 7.

Location

C:\Windows\AppCompat\Programs\Amcache.hve

Transaction log files (.LOG1, .LOG2) are located in the same directory and should be collected alongside the hive to ensure a complete and consistent parse. Dirty hives without their transaction logs may contain incomplete data.

Key Forensic Caveat: Amcache Does Not Prove Execution

An entry in Amcache does not by itself prove that a program was executed. Entries can be created through several mechanisms:

• Application installation (MSI, setup executables).

• The Microsoft Compatibility Appraiser scanning the file system for known applications.

• File discovery during automated inventory scans.

• Shimming of an application during execution.

To establish execution with higher confidence, correlate Amcache entries with Prefetch, BAM/DAM, UserAssist, PCA (Windows 11 22H2+), or process creation event logs (Sysmon Event ID 1 / Security Event ID 4688). If a file appears in both Amcache and Prefetch, confidence of execution is high.

Hive Structure

The Amcache.hve hive contains multiple root keys. The structure has evolved across Windows versions. Older versions used a Root\File key, while modern versions (Windows 10 build 14913+ onward) use InventoryApplicationFile and related keys. The most forensically relevant keys are outlined below.

InventoryApplicationFile

This is the primary key for tracking executables discovered on the system. Each subkey is named using the format filename.exe|hash_fragment and contains:

Value	Description
LowerCaseLongPath	Full file path of the executable
FileId	SHA1 hash of the first 31,457,280 bytes (30 MB) of the file, prefixed with 0000
Size	File size in bytes
LinkDate	PE compilation timestamp (from the PE header, not a file system timestamp)
BinaryType	Architecture: pe32_i386 (x86) or pe32_amd64 (x64)
Publisher	Publisher name from the file's version information
ProductName	Product name from version info
ProductVersion	Version string
ProgramId	Links this entry to a corresponding InventoryApplication entry
Language	Language code from version info

InventoryApplication

Tracks installed applications (those with an Uninstall key or MSI registration). Each subkey is named by the application's ProgramId, linking it to entries in InventoryApplicationFile.

This key contains a LastScanTime value (in Windows FILETIME format) that corresponds to the last time the Microsoft Compatibility Appraiser scheduled task ran. This is critical:

If the Compatibility Appraiser task has not run recently, InventoryApplication data may be stale or incomplete. Check Task Scheduler > Microsoft > Windows > Application Experience > Microsoft Compatibility Appraiser to verify the task's status and last run time. If this task has been disabled (common in some hardened environments), Amcache inventory data may be incomplete.

Key values include:

Value	Description
Name	Application display name
Version	Application version
Publisher	Publisher name
InstallDate	Installation date (day-level granularity only)
Source	How the application was installed (AddRemoveProgram, Msi, etc.)
UninstallString	Uninstall command path
RootDirPath	Application root directory

InventoryDriverBinary

Records information about loaded drivers, including file path, SHA1 hash, digital signature details, and modification timestamps. This key is relevant when investigating rootkits, malicious drivers, or BYOVD (Bring Your Own Vulnerable Driver) attacks.

InventoryApplicationShortcut

Records shortcut (.lnk) files associated with installed applications. The last write timestamp of each subkey provides a general indicator of when the shortcut was created or modified.

Legacy: Root\File Key

On older systems (pre-Windows 10 build 14913), executable data was stored under the Root\File key rather than InventoryApplicationFile. The subkey naming convention and available fields differ. Eric Zimmerman's AmcacheParser handles both formats automatically.

SHA1 Hash Details

The SHA1 hash stored in Amcache has specific characteristics:

• The hash covers only the first 30 MB (31,457,280 bytes) of the file. For files smaller than 30 MB, the entire file is hashed. For files larger than 30 MB, only the first 30 MB is used, meaning the hash may not match a full-file SHA1 computed by other tools or VirusTotal.

• The FileId value stores the hash with a 0000 prefix (e.g., 0000abcdef1234567890...). Strip the leading four zeros to get the actual SHA1.

• Amcache does not record hashes for all file types. It primarily covers executables (.exe, .dll) and drivers (.sys).

Practical Analysis Workflow

1. Collect the hive: Copy Amcache.hve, .LOG1, and .LOG2 from C:\Windows\AppCompat\Programs\. Use KAPE, Velociraptor, or raw disk imaging. The hive is locked on a live system, so use a tool that can handle locked files (raw copy, VSS, or forensic agent).

2. Parse with AmcacheParser:

AmcacheParser.exe -f Amcache.hve --csv C:\output\ --csvf amcache_results.csv

AmcacheParser produces separate output files for each key type: AssociatedFileEntries (files linked to installed applications), UnassociatedFileEntries (standalone executables), DeviceContainers, DriverBinaries, ShortCuts, etc.

1. Check the Appraiser status: Review the LastScanTime value in the InventoryApplication key to understand how current the data is. If the Appraiser hasn't run recently, recently installed software may not appear.

2. Cross-reference hashes: Extract SHA1 hashes (strip the 0000 prefix from FileId) and compare against threat intelligence feeds, VirusTotal, or internal IOC lists. Even after a malicious file is deleted, its hash persists in the hive.

3. Correlate ProgramIds: Use the ProgramId value to link individual executables (InventoryApplicationFile) back to their parent application (InventoryApplication). This helps distinguish between files belonging to legitimate installed software and standalone suspicious executables.

4. Timeline integration: The LinkDate (PE compilation timestamp) and subkey last write times can be incorporated into a Super Timeline for temporal analysis.

Artifact Correlation

• Prefetch: If a file appears in both Amcache and Prefetch, execution confidence is high. Prefetch provides execution timestamps that Amcache lacks.

• ShimCache: Confirms file presence on the system. On Windows 10/11, ShimCache can no longer prove execution, but the combination of ShimCache + Amcache strengthens evidence that a file was present.

• PCA (Windows 11 22H2+): The PcaAppLaunchDic.txt file provides execution timestamps with full file paths. PCA's ProgramId field can be correlated directly with Amcache entries.

• BAM/DAM: Background Activity Moderator provides execution evidence with timestamps.

• SRUM: System Resource Usage Monitor records per-application resource usage and can corroborate execution.

• $MFT / $UsnJrnl: Provides file creation and modification timestamps to complement Amcache's data about file presence.

Tools

• AmcacheParser (Eric Zimmerman): The standard tool for parsing Amcache.hve. Supports both legacy (File) and modern (InventoryApplicationFile) key formats. Outputs to CSV or JSON.

• Registry Explorer (Eric Zimmerman): Manually browse the Amcache hive structure for targeted analysis.

• RegRipper: The amcache plugin extracts and formats Amcache data. Useful for quick triage.

• KAPE: Targets for collecting Amcache.hve and modules for parsing with AmcacheParser in a single workflow.

• Velociraptor: The Windows.Forensics.Amcache artifact collects and parses Amcache data at scale across endpoints.

• Regipy (Python): Open-source registry parser for scripting and automation of Amcache analysis.

Anti-Forensics Considerations

• File deletion does not remove Amcache entries. Even after the original executable is deleted, its path, hash, and metadata persist in the Amcache hive.

• Hive deletion/corruption: An attacker with administrator privileges could delete or corrupt the Amcache.hve file, though this is relatively uncommon and would itself be suspicious.

• Appraiser task manipulation: Disabling the Compatibility Appraiser scheduled task prevents new inventory data from being written to the InventoryApplication key, but InventoryApplicationFile may still be populated through other mechanisms.

• VSS awareness: Previous versions of Amcache.hve may be recoverable from Volume Shadow Copies, providing historical snapshots of the hive.

References

• Kaspersky Securelist: AmCache artifact - forensic value and a tool for data extraction

• Psmths: Windows Forensic Artifacts - Amcache

• Magnet Forensics: ShimCache vs AmCache

• Eric Zimmerman's AmcacheParser