Where is the Amcache registry key?

Amcache is its own standalone hive file, not a key under one of the standard HKLM hives. The file lives at:

C:\Windows\AppCompat\Programs\Amcache.hve
C:\Windows\AppCompat\Programs\Amcache.hve.LOG1
C:\Windows\AppCompat\Programs\Amcache.hve.LOG2

When the Compatibility Appraiser loads the hive (or when you manually load it with reg.exe), the contents mount under HKLM\Amcache with these notable sub-keys:

Root\
├── InventoryApplicationFile     ← the headline key
├── InventoryApplication
├── InventoryDriverBinary
├── InventoryDeviceContainer
├── InventoryDevicePnp
├── InventoryApplicationShortcut
├── Programs   (legacy)
└── File       (legacy)

For the full key-by-key tour, see Amcache registry structure.

Why it's not in HKLM by default#

Amcache is one of several "lazy-mounted" hives — Windows loads it on demand when the appraiser needs it, and unloads it afterwards. This is the same pattern as per-user NTUSER.DAT hives: they only mount when the user is logged on.

On a running system you can see whether Amcache is currently loaded with:

Get-ChildItem HKLM:\ | Where-Object Name -like '*Amcache*'

If the appraiser is mid-run, you may see HKLM\Amcache listed. Most of the time the hive is unloaded and the file is closed.

Manually loading the hive#

To inspect the hive in regedit or reg.exe:

# 1. Copy the live hive to a working directory (file is locked while loaded)
Copy-Item 'C:\Windows\AppCompat\Programs\Amcache.hve' 'C:\Triage\' -Force
 
# 2. Load the copy into a temporary mount point
reg load HKLM\TempAmcache 'C:\Triage\Amcache.hve'
 
# 3. Query
reg query HKLM\TempAmcache\Root
reg query HKLM\TempAmcache\Root\InventoryApplicationFile
 
# 4. Always unload when done
reg unload HKLM\TempAmcache

For most DFIR purposes, use AmcacheParser instead — it parses the hive directly without needing to load it, produces structured CSVs, and handles transaction logs automatically.

Tagsqaforensicswindowsamcacheregistry

Related posts

  • Why is my Amcache.hve empty?

    Three common causes: the Compatibility Appraiser is disabled, the host is freshly imaged, or you're collecting from a Server / Server Core where the appraiser runs much less often.

  • What does Amcache.hve contain?

    Amcache.hve contains inventory records for every PE binary, driver, and connected device the Windows Compatibility Appraiser has seen — with SHA-1 hashes, paths, publishers, and timestamps.

  • What's a .pf file vs an Amcache entry?

    .pf files are Windows Prefetch records — proof a binary executed, with run timestamps and loaded-files lists. Amcache entries record presence, with the SHA-1 hash and metadata.

  • Is Amcache.hve a log file?

    No. Amcache.hve is a Windows registry hive — a structured key-value tree in the same binary format as SYSTEM and NTUSER.DAT — not a flat log.

← Back to all posts