Skip to content

Amcache

What Amcache is

Amcache is a Windows application-compatibility inventory stored in a registry hive. Modern systems record executable files under InventoryApplicationFile and Plug-and-Play devices under InventoryDevicePnp; older Windows versions use a legacy Root\File layout.

For executable investigation, Amcache is valuable because it can preserve a full path, SHA-1, file size, PE metadata, version information, publisher text, link date, and registry timestamps after the original file has disappeared. Device records can identify attached hardware, drivers, installation dates, and identifiers.

Best conclusion: Windows inventoried the recorded file or device. An executable record is evidence of presence, not proof of execution.

Location and collection

C:\Windows\AppCompat\Programs\Amcache.hve

Collect the hive and its adjacent Amcache.hve.LOG, .LOG1 and .LOG2 files from the affected installation. When the hive is dirty, parse-registry amcache automatically replays usable transaction logs in memory before parsing, without modifying the evidence. Recovery details are recorded in the parser log or terminal output; diagnostics go to stderr when records are streamed to stdout. Missing or unusable logs can leave records incomplete or make an inconsistent hive unreadable.

Analyst cautions

  • An Amcache executable entry does not prove that a user launched the file.
  • Publisher is PE/version-resource metadata recorded by Windows. It does not prove the file had a valid Authenticode signature at collection time.
  • Hashes may be absent and legacy/modern schemas do not expose identical values.
  • LinkDate comes from the PE header and can be forged, copied, or produced by reproducible builds.
  • A key last-write time describes the registry record's update, not necessarily download, creation, first execution, or last execution.
  • Paths can refer to removable or no-longer-present volumes.

Parse with Juntei

Usage: juntei parse-registry amcache <INPUT> [OPTIONS]

Input:
  -d, --directory <DIR>  Recursively find Amcache hives
  -f, --file <FILE>      Parse one Amcache.hve

Records:
      --files    Include every inventoried executable
      --devices  Include every inventoried PnP device
  -a, --all      Include both (default for saved structured output)

Output:
  -o, --output <PATH>       Save text/JSON/JSONL or a directory of CSV tables
  -t, --output-type <TYPE>  csv, json, jsonl, or text

# Inspect the summary and findings
juntei parse-registry amcache -f Amcache.hve

# Save all record types as CSV tables
juntei parse-registry amcache -f Amcache.hve -a -o amcache-output

# Hunt for one SHA-1 in JSONL
juntei parse-registry amcache -f Amcache.hve -t jsonl \
  | jq 'select(.RecordType == "file" and .SHA1 == "0123456789abcdef0123456789abcdef01234567")'

CSV output contains summary, findings, files, and devices tables. With auto-parse, these are Registry-Amcache-Summary.csv, Registry-Amcache-Findings.csv, Registry-Amcache-Files.csv, and Registry-Amcache-Devices.csv directly under each computer's FileExistence/ directory, with Registry-Amcache-logs.txt beside the tables. Multiple hives add -Source1, -Source2, etc. before the extension; OutputFiles in the manifests lists the exact paths. Standalone CSV exports retain their native table names and requested output location. JSONL records use RecordType values summary, finding, file, and device.

File output fields

Field How an analyst should use it
KeyName, SourceKeyPath Identify the exact source registry record and schema branch. Preserve for reproducibility.
KeyLastWrittenUTC, KeyLastWrittenFiletime Registry record update time, in readable and raw form. Do not label it an execution time.
SourceVolumeKeyLastWrittenUTC, SourceVolumeKeyLastWrittenFiletime Parent volume-key time on legacy schemas; contextual, not a file action time.
FileID Amcache's recorded file identifier. Retained exactly; do not assume it is always a SHA-1.
SHA1, SHA256 Strong pivots into Defender, threat intelligence, EDR, and file repositories. Null means not recorded.
Name, OriginalFileName, Description Recorded PE/version names. Compare with the actual path to detect masquerading; metadata is attacker-controlled.
FullPath Most useful location pivot. Normalize case carefully but retain the original evidence string.
LongPathHash Windows' path-related identifier; useful for matching records, not a content hash.
ProgramID Links the file to an application inventory record where available.
Publisher Recorded publisher text. Treat as metadata, not signature validation.
Version, BinFileVersion, ProductName, ProductVersion, BinProductVersion Version-resource context. Differences or implausible values can support masquerading analysis.
BinaryType Recorded architecture/type context; compare with PE analysis when the file is recovered.
LinkDate PE compile/link timestamp as recorded. Useful only with skepticism and corroboration.
Size Recorded size; compare with $MFT, Defender content, or a recovered file.
Language PE language identifier; a weak contextual clue, not attribution.
IsPE-File, IsOS-Component Windows' recorded classification flags. A false value does not prove harmlessness.
USN NTFS update sequence value recorded by Amcache; can help pivot to surviving USN records.
APPX-PackageFullName, APPX-PackageRelativeID Associates packaged applications/components with the file.
RegistryValues Every original registry value with type, decoded value, and raw hex. Use when a typed field is absent or for future/legacy fields.

Device output fields

Field group Fields and interpretation
Source KeyName, SourceKeyPath, KeyLastWrittenUTC, KeyLastWrittenFiletime: exact device record and registry update time.
Identity Description, BusDescription, Manufacturer, Model: human-facing device descriptions; vendor strings can be generic.
Hardware identifiers HWID, CompID, Class, ClassGUID, ContainerID, DeviceInterfaceClasses: strongest device-family and instance pivots.
State DeviceState, ProblemCode, ParentID, MatchingID, Enumerator: Windows enumeration and relationship context.
Driver DriverID, DriverName, DriverPackageStrongName, DriverVerDate, DriverVerVersion, Provider, Service, INF: driver package and service associations; correlate with installed files and services.
Installation InstallDate, FirstInstallDate, InstallState, ExtendedInfs: recorded install lifecycle. A missing date is not proof the device was never attached.
Filters and stack LowerClassFilters, UpperClassFilters, LowerFilters, UpperFilters, StackID, LocationPaths: advanced driver-stack context; unexpected filter drivers deserve review.
Raw preservation RegistryValues: complete typed/raw source values for validation and unsupported fields.

Array and raw-value columns in CSV use a JSON suffix (for example, HWID-JSON and RegistryValuesJSON); their cells contain JSON, while JSON/JSONL retains native arrays.

Investigation strategy

  1. Pivot on FullPath, SHA1, Name, and USN.
  2. Look for matching Prefetch to support execution.
  3. Use $MFT and USN Journal to establish file creation, rename, deletion, and size.
  4. Compare publisher/version metadata with an independently recovered PE and signature validation.
  5. Check Defender quarantine and event logs for detection or removal.

Further Details