Posts tagged "windows-forensics"

• What the Amcache actually tells you in a DFIR investigation

  A practitioner's view on the Amcache.hve hive: what each entry really proves, where the timestamps lie to you, and the mistakes that keep showing up in incident reports.

  2026-05-27

• Amcache vs Shimcache: which artifact answers which question

  Two adjacent Windows artifacts with very different forensic properties. What each really records, where their timestamps lie, and a decision table for casework.

  2026-05-27

• The Amcache timestamps, decoded

  Every FILETIME and DateTime-as-string field across the Amcache keys, what each really tracks, and how Win7, Win10 and Win11 disagree about the same artifact.

  2026-05-27

• The Amcache.hve binary format, in practice

  A walkthrough of the Amcache.hve on-disk structure: the regf hive layout, the subkeys that matter in DFIR, and the tools that read them without lying to you.

  2026-05-27