01Location
- C:\Windows\AppCompat\Programs\Amcache.hve
- C:\Windows\AppCompat\Programs\Amcache.hve.LOG1
- C:\Windows\AppCompat\Programs\Amcache.hve.LOG2
02Questions it answers
- Which executables were recorded on the system, and at which paths?
- What is the SHA-1 of a binary that may no longer exist on disk?
- Which programs were installed, from which source (MSI, AppX, Add/Remove Programs) and when?
- Which PE metadata (publisher, version, link date) characterise an unknown file?
03Format and versions
| Format | Windows NT Registry File (REGF) hive with transaction logs. Root key {11517B7C-E79D-4e20-961B-75A811715ADD} on Windows 8, 8.1, 10, 11 and 2012, containing a key named Root whose sub-keys vary by build (File and Programs in the older layout; Inventory* keys on Windows 10). |
|---|---|
| Applies to | Windows 7 / Server 2008 R2 and later. InventoryApplication first seen in Windows 10 1607; InventoryApplicationFile in Windows 10 1709. |
04Key fields
| Field | What it tells you |
|---|---|
| File\{volume GUID}\{file reference} (older layout) | Value 15 = path, 101 = '0000' followed by the SHA-1, 11/12 = file modification/creation FILETIME, f = PE link time (POSIX seconds), 100 = ProgramId. |
| InventoryApplicationFile | Per-file values including LowerCaseLongPath, FileId, Size, LinkDate, Publisher, Version, BinaryType, ProgramId and Usn. |
| InventoryApplication | Program records: Name, Publisher, Version, InstallDate, Source (AppxPackage, AddRemoveProgram, Msi, File), RootDirPath, UninstallString. |
| Programs (older layout) | Name, version, publisher, installation method and uninstall registry paths per ProgramId. |
| Root\Sync | REG_QWORD synchronisation date and time (FILETIME). |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| File values 11 / 12 | FILETIME (UTC) | File modification and creation times from $STANDARD_INFORMATION on NTFS; they describe the file, not an execution. |
| File value f / LinkDate | POSIX seconds / date-time string | PE header link (compilation) time of the binary, not activity on this host. |
| InventoryApplication InstallDate | Date-time string (e.g. 07/16/2016 22:55:48) | dtformats has not determined whether these strings are locale-specific. |
| Key last written time | FILETIME (UTC) | Stored per key in the REGF named-key record; not a documented execution time. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Acquire Amcache.hve together with .LOG1 and .LOG2 and apply the transaction logs before parsing.
- Identify the layout (File/Programs or Inventory*) from the sub-keys under Root.
- Extract paths, SHA-1 values (remove the four leading zeros) and PE metadata; link file entries to programs through ProgramId.
- Check hashes against known-good and known-bad sets and correlate paths with Prefetch, AppCompatCache and BAM.
07Interpretation pitfalls
- An Amcache entry should generally not be used on its own to prove program execution.
- FileId is not always a full-file hash: for large files the SHA-1 covers only the first 30 MB.
- Key layout differs between Windows 10 builds and the meaning of several values is still unknown in public documentation.
09Sources
- AMCache file (AMCache.hve) format libyal / dtformats (J. Metz) · checked 2026-10-14
- AMCache ForensicArtifacts / artifacts-kb · checked 2026-10-14
- ShimCache and AmCache Forensic Analysis Cyber Triage (Sleuth Kit Labs) · checked 2026-10-14
- AmcacheParser README Eric Zimmerman (GitHub) · checked 2026-10-14
- Windows NT Registry File (REGF) format libyal / libregf (J. Metz) · checked 2026-10-14