Amcache on Windows 11 and Windows 10: schema, cadence, and quirks
Amcache reached its mature, modern shape in Windows 10 build 1709 (Fall Creators Update) and has been broadly consistent since on Windows 10 and Windows 11. The hive on a Windows 11 workstation today is read and analysed the same way it was on Windows 10 1809 in 2018. But a handful of build-specific quirks have accumulated, and knowing them keeps you from misreading evidence.
This page is the per-build reference for modern Windows. For Server specifics, see Amcache on Windows Server. For the broader artefact reference, see the Amcache complete reference.
The schema across Windows 10 builds#
The Inventory* schema was added in Windows 10 build 1709 (Fall Creators Update, October 2017). Before that, Windows 10 used only the legacy Root\Programs and Root\File keys. Sparser data per entry.
The headline Inventory* keys added in 1709:
Root\InventoryApplicationRoot\InventoryApplicationFileRoot\InventoryDriverBinaryRoot\InventoryDeviceContainerRoot\InventoryDevicePnp
Subsequent feature updates added or refined keys but kept the overall structure stable:
| Build | Notable change |
|---|---|
| 1709 | Inventory* schema introduced. |
| 1803 | InventoryApplicationFramework added. |
| 1809 | InventoryApplicationShortcut added. |
| 1903 | InventoryDeviceInterface added. |
| 1909 | Schema refinements. |
| 2004 | InventoryDriverPackage added. |
| 20H2 | Stable. |
| 21H1 / 21H2 | Stable. |
| 22H2 | Final feature update. Stable. |
In practice: anything from Windows 10 build 1709 onward has the modern Inventory* schema and parses cleanly with current AmcacheParser.
The schema on Windows 11#
Windows 11 inherits the late-Windows-10 schema with minor additions:
InventoryMiscellaneousUUPInforecords Unified Update Platform package metadata. Rarely useful in DFIR.InventoryDeviceMediaClassmore aggressively records audio/video device sub-classifications. Useful for distinguishing USB-audio from USB-mass-storage when a single USB container exposes multiple interfaces.- Driver records under
InventoryDriverBinaryinclude slightly more package metadata, particularly WHQL signing state.
No breaking changes between Windows 10 (post-1709) and Windows 11 from a parsing standpoint. The same AmcacheParser.exe handles both.
Appraiser cadence#
The Compatibility Appraiser scheduled task populates the hive. Cadence on modern Windows:
- Windows 11 workstation: roughly daily, usually overnight when the host is idle. Trigger combines idle-time and time-based with random delay.
- Windows 10 workstation: same pattern.
- Tablet / convertible: less frequent. Power-aware, skips on battery.
- Domain-joined workstation with Microsoft Endpoint Manager: some MEM policies adjust cadence. Behaviour varies.
Practical consequence: a freshly-installed Windows 11 host that has been running under 24 hours may have a very thin Amcache. Conversely, a workstation on for years has a hive with thousands of entries spanning the full history.
Hive size on modern Windows#
Typical sizes:
| Workload | Typical hive size | Notes |
|---|---|---|
| Fresh Windows 11 install (1 week) | 2-4 MB | Few entries. Light driver / device data. |
| Standard office workstation (6 months) | 8-15 MB | Hundreds of InventoryApplicationFile rows. Full driver and device records. |
| Developer workstation (1+ year) | 25-50 MB | Thousands of entries from build artefacts. Many LinkDate clusters. |
| Server (1+ year) | 5-15 MB | Smaller. Fewer interactive apps, narrower scope. |
A hive much smaller than the workload suggests can be a flag for the appraiser being disabled (intentionally or via sabotage). See Recovering deleted-binary evidence from Amcache.
Build-specific quirks worth knowing#
A handful of quirks that catch analysts off-guard.
Windows 10 1909 / 2004 hash truncation edge case#
On a small subset of Windows 10 1909 and 2004 hives, very large binaries (>~1 GB) occasionally have an empty FileId rather than a prefix-hash FileId. The behaviour was reportedly fixed in later cumulative updates but appears in archived hives from that era. Treat empty Hash rows for large files as "no hash captured" rather than "binary is unique".
Windows 11 22H2+ device-container churn#
Windows 11 22H2 introduced more aggressive re-enumeration of device containers across Windows Update reboots, producing "new" InventoryDeviceContainer rows for devices that have been on the host for months. The KeyLastWriteTimestamp on these rows reflects the re-enumeration, not first-connect. Cross-reference with setupapi.dev.log and USBSTOR for true first-connect timestamps.
ProgramId instability across Windows feature upgrades#
A workstation upgraded from Windows 10 21H2 to Windows 11 22H2 may have different ProgramId values for the same application before and after the upgrade. The cross-host ProgramId pivot still works for hosts on the same major build. Across upgrades, also pivot on Hash (more stable across upgrades). See Amcache ProgramId explained.
Inbox app churn on Windows 11#
Windows 11 ships and removes inbox apps (built-in store apps) on a faster cadence than Windows 10 did. Frequent InventoryApplicationFile rows for the AppX layer that come and go between feature updates. Usually safely filtered by Publisher = 'Microsoft Corporation' and an AppX-style path under \Program Files\WindowsApps\.
Modern Standby / connected standby and the appraiser#
On laptops in Modern Standby / connected standby, the appraiser trigger semantics differ from a desktop. You can see slightly longer appraiser intervals (sometimes 36-48 hours) on heavily-used laptops because the idle trigger rarely fires. Account for this when reasoning about first-seen times.
Differences from older Windows#
Three things to remember when comparing Windows 10/11 Amcache to older Windows.
vs Windows 7 / Server 2008 R2#
No equivalent. Windows 7 has RecentFileCache.bcf, a flat binary. See Where Amcache.hve is on disk. Use RecentFileCacheParser instead of AmcacheParser.
vs Windows 8 / 8.1 / Server 2012 / 2012 R2#
Amcache.hve exists but with only the legacy Programs and File keys. AmcacheParser produces *_ProgramEntries.csv but no *_UnassociatedFileEntries.csv. Far less per-file detail.
vs early Windows 10 (pre-1709)#
Same legacy-only schema as Windows 8.x. The big shift to Inventory* was 1709.
Practical implications for triage#
Rules that follow from the above:
- For Windows 10 1709+ and Windows 11, AmcacheParser CSVs have both
*_UnassociatedFileEntries.csvand*_AssociatedFileEntries.csv. That's the triage focus. - For Windows 8 / 8.1 / Server 2012, focus on
*_ProgramEntries.csvand recognise per-file metadata is thin. - For Windows 7, use a dedicated
RecentFileCache.bcfparser. AmcacheParser does not handle it. - For Server builds, allow for longer appraiser intervals. Do not draw fine-grained first-seen conclusions on hour timescales.
- For laptops in Modern Standby, similar variability.
Further reading#
- Microsoft documentation for the Compatibility Appraiser scheduled task.
- AmcacheParser release notes for per-build schema additions.
- Yogesh Khatri's swiftforensics.com posts for Windows-version-specific behavioural notes.
Related#
Related posts
- Volatility and Amcache: extracting the hive from memory images
When you only have a RAM dump, Volatility extracts the in-memory copy of Amcache.hve. Hand off to AmcacheParser. The cases where this is the only option.
- RegRipper amcache plugin: what it does and when to use it
RegRipper's amcache plugin produces a plain-text Amcache report. Useful when you're already running RegRipper across other hives or need narrative output. Use AmcacheParser when you need CSV.
- AmcacheParser output columns explained: every CSV field decoded
Field-by-field reference for AmcacheParser's CSV output. FileId, PathHash, ProgramId, LinkDate, BinFileVersion, IsPeFile, and every other column, with the pivots that matter.
- AmcacheParser download guide: official sources, mirrors, and verification
Where to get AmcacheParser. Get-ZimmermanTools, direct download, KAPE, Velociraptor. Plus checksum verification and the air-gapped install pattern.