ShimCache without overclaiming
Read AppCompatCache records, interpret their timestamps, and corroborate execution claims.
Question & scope
AppCompatCache, often called ShimCache, is a compatibility-related artifact stored in the SYSTEM registry hive. It can preserve file and path observations relevant to a gaming examination even after an executable is absent from its original folder. The useful question is what the surviving record represents on this Windows build—not whether every listed path must have executed at the displayed time.
Collect the SYSTEM hive with its transaction logs through an appropriate acquisition method. A screenshot of a live cache view loses the surrounding hive context and is harder to reproduce. Multiple control sets may be relevant; preserve which control set the parser used.
What to collect
| Source | Retain and examine |
|---|---|
| SYSTEM hive | Collected hive, supporting logs, and control-set information. |
| Platform | Windows build and acquisition context. |
| Cache record | Path, record position, available metadata, and parser field definitions. |
| Corroboration | Prefetch, event logs, collected files, and MFT or journal observations. |
Examination workflow
- Preserve the hive and logs before interpreting a live tool display.
- Use a parser supporting the collected build, such as AppCompatCacheParser, and retain its version and invocation.
- Record the control set and full path for every entry used in a finding.
- Identify the source and meaning of displayed timestamps; do not relabel a file timestamp as a launch timestamp.
- Compare the path and object context with independent execution-related records before proposing a sequence of activity.
Interpretation & false positives
A compatibility record is not a universal execution verdict. Artifact behavior, persistence, and any execution-related indicators depend on the implementation and operating-system version. A recorded file modification time is a property of the observed file, not automatically the moment a user ran it.
Do not assume the order of displayed entries is a reliable chronological launch list. A parser’s ordering, control-set selection, and offline-versus-live collection affect interpretation. Absence is equally limited: a missing cache entry does not disprove activity from another well-supported source.
Worked scenario
A cache parser lists a utility with a timestamp before the disputed match. A corresponding Prefetch artifact has a later execution-related timestamp. These values need not conflict: they may describe different events. State the actual meanings, preserve both, and avoid inventing a contradiction by labeling both as launch times.
Report checklist
- Control set and operating-system context are available.
- The report identifies the actual timestamp field.
- Entry order is not presented as a launch history.
- Execution assertions use corroborating evidence.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.