Posts tagged "registry"

• Where is the Amcache registry key?

  Amcache is its own hive file at C:\Windows\AppCompat\Programs\Amcache.hve — not a key under HKLM. When loaded by tools or by Windows itself it mounts as HKLM\Amcache.

  2026-05-24

• What is Root\InventoryApplicationFile? (glossary)

  InventoryApplicationFile is the headline Amcache registry key — one sub-key per PE binary inventoried by the appraiser, with path, SHA-1, publisher, link date, and timestamps.

  2026-05-24

• Amcache registry structure: every key explained

  A key-by-key tour of the Amcache.hve registry hive — Root\\InventoryApplicationFile, InventoryApplication, InventoryDriverBinary, the legacy Programs and File keys, and what every notable value means.

  2026-05-24

• Amcache: the complete Windows .hve forensics reference

  Amcache is the Windows registry hive that records every PE binary the appraiser has inventoried, with SHA-1, path, publisher, and inventory time. Full reference.

  2026-05-24