Posts tagged "reference"

• AmcacheParser output columns explained: every CSV field decoded

  Field-by-field reference for AmcacheParser's CSV output. FileId, PathHash, ProgramId, LinkDate, BinFileVersion, IsPeFile, and every other column, with the pivots that matter.

  2026-05-24

• The definitive Amcache.hve forensic reference: every key, every value, every timestamp

  Field-by-field, schema-by-schema. What each Inventory* sub-key holds, what every timestamp means, how the schema evolved from Windows 7 to 11, and what Amcache will and will not prove.

  2026-05-24