What is Root\InventoryApplicationFile? (glossary)

Root\InventoryApplicationFile is the principal registry key inside Amcache.hve. It contains one sub-key per PE binary the Compatibility Appraiser has inventoried, with rich metadata per entry: full path, SHA-1, publisher, version, link date, and inventory timestamp.

This is the key DFIR analysts spend 90% of their Amcache time in. Together with Root\InventoryApplication, it answers the canonical Amcache question: "was this binary ever present on this host, and what is it?"

Notable values per entry#

Value	Meaning
Name	File name only (e.g. mimikatz.exe).
LowerCaseLongPath	Full path, lowercased.
FileId	"0000" + SHA-1 hex of the first 31 MiB.
Size	File size in bytes.
IsPeFile	1 if the file is a PE.
IsOsComponent	1 if part of Windows itself.
Publisher / PublisherName	Publisher strings.
Version / BinFileVersion / ProductVersion	Version strings.
ProductName	PE resource ProductName.
LinkDate	PE TimeDateStamp.
Language	PE resource language ID.
ProgramId	44-char application-identity hash.
Usn	USN journal entry at inventory time.

Plus the registry-level KeyLastWriteTimestamp (not a value; the registry key's own last-write metadata) — which is the closest thing Amcache exposes to "when did the appraiser record this?".

Why analysts care#

InventoryApplicationFile is the single richest Windows source for post-deletion file evidence. A wiper can remove the file from disk; the entry persists in the hive for months. The combination of hash + path + publisher + inventory time is enough to identify a binary, verify it against VirusTotal, and bound when it appeared on the host — all without the binary itself.

Triage filter#

The standard "is this suspicious?" filter applied to the AmcacheParser CSV of this key:

IsPeFile = True
AND Publisher is empty
AND FullPath is under \Users\, \AppData\, \ProgramData\, or \Temp\

That single filter surfaces the vast majority of commodity-malware artefacts on a typical infected host.

For the full registry-structure tour, see Amcache registry structure.

Related terms#

• Amcache.hve — the hive.
• FileId — the content hash per entry.
• ProgramId — the application identity per entry.
• KeyLastWriteTimestamp — the inventory-time pivot.
• LinkDate — the PE compile-time field.