Where is the Amcache registry key?

Amcache is its own standalone hive file, not a key under HKLM. The file lives at:

C:\Windows\AppCompat\Programs\Amcache.hve
C:\Windows\AppCompat\Programs\Amcache.hve.LOG1
C:\Windows\AppCompat\Programs\Amcache.hve.LOG2

When the Compatibility Appraiser loads it (or when you load it yourself with reg load), the contents mount under HKLM\Amcache with:

Root\
├── InventoryApplicationFile     <- the headline key
├── InventoryApplication
├── InventoryDriverBinary
├── InventoryDeviceContainer
├── InventoryDevicePnp
├── InventoryApplicationShortcut
├── Programs   (legacy)
└── File       (legacy)

For the full key-by-key tour, see Amcache registry structure.

"Registry key" vs "hive file" — the distinction that trips people up#

The reason "where is the Amcache registry key" is a confusing question is that Amcache is both and neither in the way people expect:

• It is not a key sitting permanently under HKLM\SOFTWARE or HKLM\SYSTEM like most settings. You will not find it by browsing regedit on a default system.
• It is a registry hive — the same binary format as SYSTEM, SOFTWARE, and NTUSER.DAT — stored as a standalone file on disk. When mounted, its contents are addressed as registry keys under HKLM\Amcache\Root\....

So the honest answer to "where is the key" is: the data lives in a file (Amcache.hve), and it only becomes a set of registry keys when something — the appraiser, or you — mounts that file. Forensically you almost never touch the mounted form; you copy the file and parse it offline. The file location is covered in where Amcache.hve lives on disk.

Why it isn't in HKLM by default#

Amcache is a lazy-mounted hive. Windows loads it when the appraiser needs it and unloads it afterwards. Same pattern as per-user NTUSER.DAT hives: only mounted when the user is logged on.

You can see whether Amcache is currently loaded with:

Get-ChildItem HKLM:\ | Where-Object Name -like '*Amcache*'

Mid-appraiser-run you may see HKLM\Amcache listed. Most of the time the hive is unloaded and the file is closed.

Manually loading the hive#

If you want to walk it in regedit or reg.exe:

# Copy the live hive (file is locked while loaded)
Copy-Item 'C:\Windows\AppCompat\Programs\Amcache.hve' 'C:\Triage\' -Force
 
# Load the copy
reg load HKLM\TempAmcache 'C:\Triage\Amcache.hve'
 
# Query
reg query HKLM\TempAmcache\Root
reg query HKLM\TempAmcache\Root\InventoryApplicationFile
 
# Always unload
reg unload HKLM\TempAmcache

For real DFIR work, use AmcacheParser instead. It parses the hive directly without needing to load it under HKLM, replays the transaction logs automatically, and produces structured CSVs. reg.exe is fine for ad-hoc spelunking. It is not fine for actual analysis. Once you have it parsed, how to find evidence of execution with Amcache walks the rest of the workflow.

What lives under each key#

Once mounted, the keys under Root are where the evidence is. The headline one, InventoryApplicationFile, holds a sub-key per PE with its SHA-1, path, and publisher; InventoryDeviceContainer and InventoryDevicePnp hold USB and device history; InventoryDriverBinary holds driver binaries. The field-by-field meaning of every value is in AmcacheParser output columns, and the conceptual overview in understanding Amcache.

Related#

• Where Amcache.hve is on disk
• Amcache registry structure
• AmcacheParser complete guide
• How to find evidence of execution with Amcache
• Understanding Amcache