01Location
- SYSTEM hive: ControlSet00n\Control\Session Manager\AppCompatCache (value AppCompatCache)
- SYSTEM hive: ControlSet00n\Control\Session Manager\AppCompatibility (Windows 2000 and XP)
02Questions it answers
- Was a file with this path known to the compatibility subsystem, including files since deleted?
- What was the file's last modification time when it was cached?
- On Vista/7, is the execution-related insertion flag set for an entry?
- Which entries sit next to a known malicious entry in the cache order?
03Format and versions
| Format | REG_BINARY blob with a version-specific header and entries. Windows 7: 128-byte header, signature bytes ee 0f dc ba. Windows 8.0/8.1: entries signed '00ts'/'10ts'. Windows 10: 48-byte header (52 bytes from the Creators Update) and '10ts' entries. Paths are UTF-16LE; times are FILETIME. |
|---|---|
| Applies to | Windows XP to Windows 11; winreg-kb suggests up to 512 entries on Windows 2003 and 1024 on Vista/7. |
04Key fields
| Field | What it tells you |
|---|---|
| Path | UTF-16LE path of the cached file. |
| Last modification time | File last modification time as stored in $STANDARD_INFORMATION on NTFS. |
| File size | Present in Windows XP and 2003 entries. |
| Insertion flags (Vista/7) | Flag 0x00000002 has been observed to be set by CSRSS during process creation; its official meaning is undocumented. |
| Entry data (Windows 10) | If the last 4 bytes of an entry equal 1 there is a high likelihood the entry was executed (Cyber Triage). |
| Entry order | Entries are populated top-down as a least-recently-used queue; the most recent are at the top. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Last modification time | FILETIME (UTC) | Time the file's content was last modified; it is not the execution or insertion time. |
| Last update time (Windows XP 32-bit) | FILETIME (UTC) | Second time value present only in the XP 32-bit entry format. |
| Key last written time | FILETIME (UTC) | The value is written to the registry on a proper reboot or shutdown, so the key time reflects that write. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Parse every ControlSet00n in the SYSTEM hive after applying its transaction logs.
- Identify the version-specific structure from header size and signatures.
- Preserve entry order and review entries clustered around known malicious paths.
- Treat timestamps as file modification times and corroborate execution with Prefetch, Amcache, BAM and event logs.
07Interpretation pitfalls
- On Windows 10 and later an entry does not prove execution; on Vista, 7, 2008 and 2012 entries can be created for files in a directory the user merely browsed.
- Data is only written to the registry on a proper reboot or shutdown; entries added since the last boot may be missing from an acquired hive.
- The cache rolls: the oldest entries are replaced by new ones.
- Insertion and shim flags are not documented by Microsoft; their interpretation rests on research observations.
09Sources
- Application compatibility cache libyal / winreg-kb · checked 2026-10-14
- Caching Out: The Value of Shimcache for Investigators (T. Parisi, 2015) Mandiant / Google Cloud Threat Intelligence · checked 2026-10-14
- ShimCache and AmCache Forensic Analysis Cyber Triage (Sleuth Kit Labs) · checked 2026-10-14
- RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14
- AppCompatCacheParser README Eric Zimmerman (GitHub) · checked 2026-10-14