Posts tagged "timestamps"

• What is LinkDate in Amcache? (glossary)

  LinkDate is the PE header TimeDateStamp Amcache records — when the binary was compiled or linked, not when it appeared on the host.

  2026-05-24

• What is KeyLastWriteTimestamp in Amcache? (glossary)

  KeyLastWriteTimestamp is the registry-level last-write time of an Amcache entry — the closest thing Amcache exposes to 'when the appraiser recorded this file'.

  2026-05-24

• Amcache timestamps explained: KeyLastWriteTimestamp vs LinkDate vs the rest

  A reference for every timestamp Amcache exposes — KeyLastWriteTimestamp, LinkDate, InstallDate, MsiInstallDate, LastModified — what each one means, and which one to pivot on.

  2026-05-24