Is AmcacheParser free?

Yes. AmcacheParser is free for any use — personal, commercial, internal, consulting engagements, government work, training. It is published under the MIT license by Eric Zimmerman on GitHub and at ericzimmerman.github.io.

There are no tiers, no nag screens, no telemetry, no account, no limits.

Who publishes it#

Eric Zimmerman is a former FBI special agent and currently a Senior Director at Kroll. He has published open-source DFIR tooling for over a decade. AmcacheParser is one of about a dozen tools he maintains — the others include:

  • MFTECmd — $MFT, $LogFile, $J, $Boot, $SDS parser
  • RECmd — registry command-line and batch processor
  • RBCmd — Recycle Bin parser
  • PECmd — Prefetch parser
  • EvtxECmd — Windows Event Log parser
  • JLECmd — Jump List parser
  • LECmd — LNK parser
  • SBECmd — Shellbag Explorer CLI
  • AppCompatCacheParser — ShimCache parser
  • SrumECmd — SRUM parser

All free, all MIT-licensed.

Commercial alternatives#

Several commercial DFIR suites also parse Amcache as part of larger packages:

  • Magnet AXIOM — Magnet Forensics' integrated DFIR platform.
  • X-Ways Forensics — German DFIR suite.
  • EnCase — OpenText's classic forensic platform.
  • FTK — Exterro's forensic toolkit.

These are paid (often $$$$) but bundle dozens of artefact parsers, evidence-management features, and certifications. For Amcache-specifically — meaning if you just need to parse the hive — AmcacheParser is the canonical free option and produces output that most paid platforms can ingest.

Is there any catch?#

Functionally: no. Practically, two limitations to be aware of:

  1. No vendor support. AmcacheParser is open source. If you hit a bug, the right path is a GitHub issue, not a support ticket. Eric and the community are responsive but there is no SLA.
  2. Windows-first. The tool runs cross-platform via .NET, but the documentation and ecosystem assume Windows. Linux / macOS users follow the Linux/macOS guide.

What about this site?#

The browser-based parser at amcacheparser.com is also free and runs entirely client-side. It is an independent re-implementation of the Amcache read path in Rust + WebAssembly, designed for triage and education. It is not affiliated with Eric or Kroll. The file you drop on the page is parsed in your browser and never sent to a server.

For full investigations on a Windows analyst workstation, use Eric's AmcacheParser.exe. For triage or no-install scenarios, use the browser-based version. Both are free.

Tagsqaamcacheparserlicensing

Related posts

  • Who created AmcacheParser?

    Eric Zimmerman, a former FBI special agent and current Senior Director at Kroll, created AmcacheParser as part of his open-source DFIR tool suite.

  • Why is my Amcache.hve empty?

    Three common causes: the Compatibility Appraiser is disabled, the host is freshly imaged, or you're collecting from a Server / Server Core where the appraiser runs much less often.

  • Where is the Amcache registry key?

    Amcache is its own hive file at C:\Windows\AppCompat\Programs\Amcache.hve — not a key under HKLM. When loaded by tools or by Windows itself it mounts as HKLM\Amcache.

  • What does Amcache.hve contain?

    Amcache.hve contains inventory records for every PE binary, driver, and connected device the Windows Compatibility Appraiser has seen — with SHA-1 hashes, paths, publishers, and timestamps.

← Back to all posts