BergssonForensics.
Menu
← Back to catalogue
Programs & execution

ShimCache / AppCompatCache

The application compatibility cache keeps information about executable files Windows has encountered. Interpretation is version-specific, and modern cache presence must not be treated as a universal execution flag.

Listen to the full guide

Download MP32 min · AI narration

Useful for

Support that Windows encountered a particular executable path.

Important limit

Prove a run time from the cached file modification time.

Location & availability

SYSTEM hive: ControlSet...\Control\Session Manager\AppCompatCache

The on-disk hive and live cached state can differ. Do not reboot a player machine just to force a cache update.

Fields to examine

  • Executable path and parser-supported flags.
  • Recorded file modification time, not automatically a run timestamp.
  • Control set, Windows build and collection state.

What it can establish

  • Support that Windows encountered a particular executable path.
  • Provide a path and metadata lead for correlation.

What it cannot prove

  • Prove a run time from the cached file modification time.
  • Infer execution on every Windows version merely from entry order or presence.

Use it in a screenshare

  1. Preserve the relevant SYSTEM hive and record whether it was collected live or from an image.
  2. Parse with AppCompatCacheParser for the source build. Note which control set and entry flags the tool interprets.
  3. Compare the path with Amcache and Prefetch. Keep the difference between encounter, inventory and execution explicit in the report.

Worked example

The cache lists a utility that the player denies running. It may have been inspected or inventoried. A matching process creation event would materially strengthen the claim; a cache entry by itself does not settle the dispute.

Cross-check the finding

  • Amcache →Show that Windows inventoried a file or application identity.
  • Prefetch →Support execution of an associated executable within the retained history.
  • BAM →Support recent executable activity associated with a Windows user SID.

Sources

Choose another artefact →