Posts tagged "anti-forensics"

• Can Amcache be cleared by attackers?

  Yes, an admin can delete or edit Amcache.hve, but a cleaned Amcache is rarely invisible: shadow copies, .LOG1/.LOG2 files and hive timestamps expose it.

  2026-05-24

• Recovering deleted-binary evidence from Amcache

  Amcache outlives the binaries it records. Path, SHA-1, publisher, link date, and inventory time persist for months after the attacker wipes the file. The practical workflow.

  2026-05-24