Posts tagged "qa"

• Why is my Amcache.hve empty?

  Three causes in order of frequency: appraiser disabled, host freshly imaged, or you're on a Server where the cadence is naturally slow. Tampering is a distant fourth.

  2026-05-24

• Who created AmcacheParser?

  Eric Zimmerman. Ex-FBI, now Senior Director at Kroll. Maintains the de facto standard Windows DFIR tool suite.

  2026-05-24

• Where is the Amcache registry key?

  Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.

  2026-05-24

• What does Amcache.hve contain?

  Inventory records for every PE, driver, application, and connected device the Compatibility Appraiser has seen. SHA-1, full path, publisher, and timestamps per entry.

  2026-05-24

• What's a .pf file vs an Amcache entry?

  .pf is execution proof with run times. Amcache is presence with hash and metadata. Same binary in both, only one, or neither, and which combination it is matters.

  2026-05-24

• Is AmcacheParser free?

  Yes. MIT-licensed, free for any use including commercial DFIR. The rest of Eric Zimmerman's tools too.

  2026-05-24

• Is Amcache.hve a log file?

  No. It's a registry hive in the same binary format as SYSTEM and NTUSER.DAT. A tree of typed keys, not a flat append-only stream.

  2026-05-24

• How do I read Amcache.hve on Linux or macOS?

  Three options. dotnet AmcacheParser.dll, the browser parser on this site, or any libhivex-based tool. None of them require Windows.

  2026-05-24

• How often is Amcache updated?

  Roughly daily on Windows 10/11 workstations. Every 2-5 days on Servers. Weeks on Server Core. Amcache lags reality. Plan timelines around that.

  2026-05-24

• Does Amcache record DLLs?

  Yes, on Windows 10 build 1709 and later. InventoryApplicationFile records both EXEs and DLLs classified as PE. Pre-1709 hives can't be trusted to.

  2026-05-24

• Can Amcache be cleared by attackers?

  Yes, with admin. No, not cleanly. Shadow copies, transaction logs, and the appraiser's own footprint usually preserve the prior state. Tampering is one of the more reliably caught attacker behaviours on Windows.

  2026-05-24

• What's the difference between Amcache and AppCompatCache?

  Amcache is rich, appraiser-maintained, with hashes. AppCompatCache (Shimcache) is sparse, kernel-maintained, with paths and a modify timestamp. Use both. The gaps between them are information.

  2026-05-24