Posts tagged "timestamps"

• The Amcache timestamps, decoded

  Every FILETIME and DateTime-as-string field across the Amcache keys, what each really tracks, and how Win7, Win10 and Win11 disagree about the same artifact.

  2026-05-27

• What is LinkDate in Amcache? (glossary)

  LinkDate is the PE TimeDateStamp. Attacker-controllable. Use it for build clustering, not for host timelines.

  2026-05-24

• What is KeyLastWriteTimestamp in Amcache? (glossary)

  The registry write time of the Amcache key. Closest thing to 'when the appraiser recorded this'. The single field new analysts most often confuse with LinkDate.

  2026-05-24

• Amcache timestamps explained: KeyLastWriteTimestamp vs LinkDate vs the rest

  Every timestamp Amcache exposes, what each one means, and which one to pivot on. Confusing them is the #1 mistake new analysts make.

  2026-05-24