Posts tagged "program-execution"

• Amcache forensics: how to find evidence of execution

  Use Amcache.hve to prove a program ran on Windows: acquire, parse, filter, pivot on SHA-1, corroborate — plus the limits that catch analysts out.

  2026-06-12

• What the Amcache actually tells you in a DFIR investigation

  A practitioner's view on the Amcache.hve hive: what each entry really proves, where the timestamps lie to you, and the mistakes that keep showing up in incident reports.

  2026-05-27

• Amcache vs Shimcache: which artifact answers which question

  Two adjacent Windows artifacts with very different forensic properties. What each really records, where their timestamps lie, and a decision table for casework.

  2026-05-27