What is KeyLastWriteTimestamp in Amcache? (glossary)

KeyLastWriteTimestamp is the last time the registry wrote the key holding this Amcache entry. Surfaced by AmcacheParser as a column on every CSV. It is the most important timestamp in Amcache, and the one most often confused with LinkDate. They are not the same and they answer different questions.

What it represents#

Every registry key has a last-write time written by Windows itself. When the appraiser creates or updates an entry under Root\InventoryApplicationFile, that key's last-write advances. AmcacheParser reads it and exposes it as KeyLastWriteTimestamp.

In practice:

• First time the appraiser inventories a file, the timestamp is the appraiser-run time after the file was noticed. Upper bound for "first present on disk".
• Metadata changes (new hash, larger size, version string change) advance the timestamp.
• A stable file whose metadata never changes keeps the same timestamp even after many subsequent appraiser passes. It is "last written to", not "last seen".

That last bullet is what catches people. A binary present and unchanged for two years has a KeyLastWriteTimestamp two years old.

The four timestamps and which one to use#

Question	Field
When did Amcache record this?	KeyLastWriteTimestamp
When was the binary compiled?	LinkDate
When did the file land on disk?	MFT $STANDARD_INFORMATION.CreationTime
When did it execute?	Prefetch run times

The standard time-window pivot#

Take a suspicious row. Take its KeyLastWriteTimestamp. Open a one-hour window centred on it. Pull from that window:

• Other Amcache rows on the same host.
• Prefetch entries.
• Sysmon 1 (process create), 7 (image load), 11 (file create).
• Security 4688.
• MFT and USN journal creates.

That's the canonical reconstruction. Almost every Amcache-based finding ends up running this pivot at least once.

For the long-form reference, see Amcache timestamps explained.

Related terms#

• LinkDate
• Compatibility Appraiser
• InventoryApplicationFile