Posts tagged "shimcache"

• Amcache vs Shimcache: which artifact answers which question

  Two adjacent Windows artifacts with very different forensic properties. What each really records, where their timestamps lie, and a decision table for casework.

  2026-05-27

• What is Shimcache (AppCompatCache)? (glossary)

  Shimcache is the kernel-maintained loader cache in the SYSTEM hive. 1024 entries, no hash, stale until reboot. Different from Amcache; pair them.

  2026-05-24

• What's the difference between Amcache and AppCompatCache?

  Amcache is rich, appraiser-maintained, with hashes. AppCompatCache (Shimcache) is sparse, kernel-maintained, with paths and a modify timestamp. Use both. The gaps between them are information.

  2026-05-24