Posts tagged "registry"

• The Amcache.hve binary format, in practice

  A walkthrough of the Amcache.hve on-disk structure: the regf hive layout, the subkeys that matter in DFIR, and the tools that read them without lying to you.

  2026-05-27

• Where is the Amcache registry key?

  Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.

  2026-05-24

• What is Root\InventoryApplicationFile? (glossary)

  The principal Amcache key. One sub-key per PE the appraiser inventoried, with hash, path, publisher, link date, and a registry write time. Where 90% of analyst time goes.

  2026-05-24

• Amcache registry structure: every key explained

  Key-by-key tour of Amcache.hve. Root\InventoryApplicationFile, InventoryApplication, InventoryDriverBinary, the legacy Programs and File keys, and what every notable value means.

  2026-05-24

• Amcache: the complete Windows .hve forensics reference

  Amcache is the hive the Compatibility Appraiser writes every PE on disk into, with SHA-1, full path, publisher, link date, and a key write time. The reference, from format to investigative use.

  2026-05-24