Posts tagged "qa"

• Why is my Amcache.hve empty?

  Three causes in order of frequency: appraiser disabled, host freshly imaged, or you're on a Server where the cadence is naturally slow. Tampering is a distant fourth.

  2026-05-24

• Who created AmcacheParser?

  Eric Zimmerman. Ex-FBI, now Senior Director at Kroll. Maintains the de facto standard Windows DFIR tool suite.

  2026-05-24

• Where is the Amcache registry key?

  Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.

  2026-05-24

• What does Amcache.hve contain?

  Inventory records for every PE, driver, application, and connected device the Compatibility Appraiser has seen. SHA-1, full path, publisher, and timestamps per entry.

  2026-05-24

• What's a .pf file vs an Amcache entry?

  .pf is execution proof with run times. Amcache is presence with hash and metadata. Same binary in both, only one, or neither, and which combination it is matters.

  2026-05-24

• Is AmcacheParser free? Yes — MIT-licensed, commercial OK

  Yes. MIT-licensed, free for any use including commercial DFIR. The rest of Eric Zimmerman's tools too.

  2026-05-24

• Is Amcache.hve a log file?

  No. It's a registry hive in the same binary format as SYSTEM and NTUSER.DAT. A tree of typed keys, not a flat append-only stream.

  2026-05-24

• How do I read Amcache.hve on Linux or macOS?

  Three options. dotnet AmcacheParser.dll, the browser parser on this site, or any libhivex-based tool. None of them require Windows.

  2026-05-24

• How often is Amcache updated?

  Roughly daily on Windows 10/11 workstations. Every 2-5 days on Servers. Weeks on Server Core. Amcache lags reality. Plan timelines around that.

  2026-05-24

• Does Amcache record DLLs?

  Yes, on Windows 10 build 1709 and later. InventoryApplicationFile records both EXEs and DLLs classified as PE. Pre-1709 hives can't be trusted to.

  2026-05-24

• Can Amcache be cleared by attackers?

  Yes, an admin can delete or edit Amcache.hve, but a cleaned Amcache is rarely invisible: shadow copies, .LOG1/.LOG2 files and hive timestamps expose it.

  2026-05-24

• What's the difference between Amcache and AppCompatCache?

  Amcache is rich, appraiser-maintained, with hashes. AppCompatCache (Shimcache) is sparse, kernel-maintained, with paths and a modify timestamp. Use both. The gaps between them are information.

  2026-05-24