Amcache: inventory with context
Use Amcache to identify software and paths while keeping inventory evidence distinct from proof of execution.
Question & scope
Amcache is useful when an examination involves a program that has been renamed, moved, or removed. On relevant Windows systems, the Amcache hive is commonly found under Windows\AppCompat\Programs. Preserve the hive with associated transaction logs when your acquisition method supports them, and record the Windows build. Its structures and field meanings vary across versions, so select a parser that supports the collected format.
Treat the output as a set of recorded application or file observations. Start with identity and path questions: which record refers to the item, what metadata survived, and what other source can establish activity? Avoid translating every inventory entry into a specific launch time.
What to collect
| Source | Retain and examine |
|---|---|
| Amcache hive | A collected Amcache.hve and relevant transaction logs. |
| System context | Windows build, collection method, and acquisition time. |
| Parser output | Record type, recorded path, timestamps, and available file-identifying metadata. |
| Related evidence | Matching files, Prefetch, event logs, and filesystem records. |
Examination workflow
- Acquire the hive and its supporting logs as a coherent collection rather than relying only on a screenshot of registry values.
- Parse a copy using a version-aware tool such as AmcacheParser, retaining the original output and tool version.
- Search both names and path context. Resolve multiple similarly named records before choosing one.
- Compare available identifying metadata with the collected binary or an exact reference, checking how the parser defines each field.
- Correlate relevant entries with execution and filesystem artifacts and record which source supports each part of the timeline.
Interpretation & false positives
Inventory can be populated through mechanisms other than the launch you are investigating. The meaning of a timestamp depends on the record type, Windows version, and field definition. A recorded path is valuable context, but the presence of an entry alone does not provide a complete execution history or prove cheating.
If a parser emits a hash-like field, check the implementation and documentation before assuming it covers all bytes or equals a separately calculated cryptographic hash. Preserve the original record identity so another analyst can revisit that interpretation. Missing entries may reflect collection, configuration, version differences, or retention.
Worked scenario
An Amcache entry refers to a suspiciously named utility under a temporary folder. A related Prefetch record and a collected service event are more direct leads for execution context. Report the Amcache path as inventory evidence and discuss the other sources separately. If the file cannot be recovered, do not claim that its name establishes its code or capability.
Report checklist
- The Windows build and parser version are recorded.
- Inventory, identity, and execution claims are distinguished.
- Timestamp meanings are documented rather than assumed.
- Matching records have paths and source identifiers.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.