Posts tagged "timestamps"
- What is LinkDate in Amcache? (glossary)
LinkDate is the PE header TimeDateStamp Amcache records — when the binary was compiled or linked, not when it appeared on the host.
2026-05-24
- What is KeyLastWriteTimestamp in Amcache? (glossary)
KeyLastWriteTimestamp is the registry-level last-write time of an Amcache entry — the closest thing Amcache exposes to 'when the appraiser recorded this file'.
2026-05-24
- Amcache timestamps explained: KeyLastWriteTimestamp vs LinkDate vs the rest
A reference for every timestamp Amcache exposes — KeyLastWriteTimestamp, LinkDate, InstallDate, MsiInstallDate, LastModified — what each one means, and which one to pivot on.
2026-05-24