Does AmcacheParser actually work on Linux?

Yes. Install .NET 6 or .NET 9 (matching the build you downloaded), then run 'dotnet AmcacheParser.dll' with the usual flags. Same output.

What about macOS, including Apple Silicon?

Same approach. 'brew install dotnet' or the official installer, then run 'dotnet AmcacheParser.dll'. The Zimmerman builds are arch-aware.

What's the no-install option?

Drop the hive on the browser parser at amcacheparser.com. WebAssembly, runs in any modern browser, file stays in the browser, no upload.

Can I parse Amcache with Python on Linux?

Yes, using libhivex (apt install python3-hivex) or python-registry. You'll need to walk the Inventory* keys and decode FILETIME values yourself. There's no off-the-shelf Python parser that produces the same CSV schema as AmcacheParser.

What if I only have a memory image?

Use Volatility to extract the hive from the memory dump, then parse the extracted file with any of the above options. See the Volatility guide.

How do I read Amcache.hve on Linux or macOS?

You don't need Windows to read Amcache. Three options, in order from "full investigation" to "quick look".

Option 1: dotnet AmcacheParser.dll#

The Zimmerman build is framework-dependent .NET. Install the runtime, run the DLL. Same tool, same flags, same output.

# Debian / Ubuntu
sudo apt install dotnet-runtime-6.0
 
# RHEL / Fedora
sudo dnf install dotnet-runtime-6.0
 
# macOS
brew install dotnet
 
# Run
dotnet /opt/ztools/net6/AmcacheParser/AmcacheParser.dll \
  -f   /cases/inc-042/HOST01/Amcache.hve \
  --csv /cases/inc-042/HOST01/out \
  --csvf HOST01_amcache.csv \
  --mp

You get the same per-category CSVs you would on Windows. Right choice for a full investigation on a non-Windows analyst host.

Option 2: browser, no install#

Drop Amcache.hve on this site's home page. The parser runs entirely in your browser. The file never leaves your browser. Parsing is Rust compiled to WebAssembly. Works on:

Any desktop OS with a modern browser.
ChromeOS, BSD, anything with a browser.
Mobile, though the UI is desktop-first.

Right for triage, education, and quick lookups when you do not want to install anything. For a full investigation on a non-Windows workstation, prefer Option 1, because the CLI is scriptable.

Option 3: libhivex / Python#

For programmatic access. libhivex is the Linux registry-hive library and has Python bindings:

import hivex
h = hivex.Hivex('/cases/inc-042/HOST01/Amcache.hve')
root = h.root()
inv = h.node_get_child(root, 'Root')
inv_files = h.node_get_child(inv, 'InventoryApplicationFile')
for child in h.node_children(inv_files):
    name = h.node_name(child)
    values = {h.value_key(v): h.value_value(v) for v in h.node_values(child)}
    print(name, values)

You will need to decode Windows FILETIME values, parse the "0000" + SHA-1 FileId format, and walk the tree yourself. There is no off-the-shelf Python parser producing the same CSV schema as AmcacheParser. If you need scripted access this is the right primitive.

From a memory image#

If all you have is a Windows RAM dump, use Volatility to extract the in-memory hive first:

vol -f memory.dmp windows.registry.hivelist | grep -i amcache
vol -f memory.dmp windows.registry.dumphive --offset 0xfffff8a0... > Amcache.hve

Then parse the dumped hive with Option 1, 2, or 3. The full memory workflow is in Volatility and Amcache.

Quick decision table#

You want	Use
Full investigation, structured CSV	Option 1
Quick triage, no install	Option 2
Script integration or custom pipeline	Option 3
Parse from memory	Volatility, then Option 1

For the broader artefact context, see the Amcache complete reference.