Amcache

Location & availability

C:\Windows\AppCompat\Programs\Amcache.hve, companion logs and Inventory*.db files where present

Keys and meanings vary by Windows build. Recent formats may use neighbouring inventory databases; preserve available database journals as well as hive logs.

Fields to examine

• Recorded path, file size, publisher and version when available.
• File identifiers or SHA-1-related fields; their hashing scope can differ from a complete file hash.
• Inventory key times and PE metadata, each with its own meaning.

What it can establish

• Show that Windows inventoried a file or application identity.
• Help connect an old path or filename to a collected program.

What it cannot prove

• Prove execution from an inventory entry alone.
• Use a PE compilation timestamp or registry LastWrite as an exact run time.

Use it in a screenshare

1. Acquire the hive with a trusted collection tool; a screenshot of a parser table is not the source hive.
2. Parse a copy using AmcacheParser and retain the parser version. Distinguish installed-application entries from individual file entries.
3. Compare candidate identities with Prefetch or process events. Explain any partial-hash or build-specific interpretation before comparing hashes.

Worked example

Amcache contains a deleted executable in Downloads. This supports historical inventory of that path. With no independent run artifact, the defensible conclusion is that execution remains unconfirmed, even if the filename resembles a known tool.

Cross-check the finding

• Prefetch →Support execution of an associated executable within the retained history.
• ShimCache / AppCompatCache →Support that Windows encountered a particular executable path.
• Security event 4688 →Support process creation recorded by the audited host.

Sources

• AmcacheParser — parser documentation ↗