Is Amcache.hve a log file?

No. Amcache.hve is a Windows registry hive in the regf binary format. Same format as the SYSTEM, SOFTWARE, and NTUSER.DAT hives. A tree of keys and typed values. Not a flat log.

The distinction matters in practice:

  • A log file appends events sequentially. Each line is a discrete event. Readers parse line-by-line.
  • A registry hive holds a tree of keys (like folders) and typed values (REG_SZ, REG_DWORD, REG_QWORD, REG_BINARY). Readers walk the tree.

Amcache stores one sub-key per inventoried PE binary under Root\InventoryApplicationFile. Each sub-key has 15-20 typed values: name, path, SHA-1 hash, link date, publisher, version, etc. Updates happen in place. Old values are overwritten, not appended after.

What about the .LOG files#

Amcache.hve.LOG1 and Amcache.hve.LOG2 are log files, but they are registry transaction logs, not event logs. The same write-ahead log mechanism every registry hive uses to buffer recent writes before flushing into the main file. Binary, not human-readable, and not used for event auditing.

Always grab all three files together. If you only take the hive, you can silently miss the most recent writes that were still buffered in the logs at acquisition time. AmcacheParser will replay them automatically if they are next to the hive.

For path and collection workflow, see Where Amcache.hve is on disk.

How to actually read it#

You need a hive-aware parser:

  • AmcacheParser (Eric Zimmerman). Canonical Windows-side CLI. CSV output. See the AmcacheParser complete guide.
  • RegRipper amcache plugin (Harlan Carvey). Text-report output. See RegRipper amcache plugin.
  • This site's browser parser. Rust + WebAssembly, no install. Drop the hive on the home page.

For the broader artefact context, see the Amcache complete reference.

Tagsqaforensicswindowsamcache

Related posts

  • Why is my Amcache.hve empty?

    Three causes in order of frequency: appraiser disabled, host freshly imaged, or you're on a Server where the cadence is naturally slow. Tampering is a distant fourth.

  • Where is the Amcache registry key?

    Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.

  • What does Amcache.hve contain?

    Inventory records for every PE, driver, application, and connected device the Compatibility Appraiser has seen. SHA-1, full path, publisher, and timestamps per entry.

  • What's a .pf file vs an Amcache entry?

    .pf is execution proof with run times. Amcache is presence with hash and metadata. Same binary in both, only one, or neither, and which combination it is matters.

← Back to all posts