Skip to content
AIR Knowledge Base

AmCache

Overview

Section titled “Overview”

Evidence: AmCache
Description: Collect Amcache and Parse
Category: System
Platform: windows
Short Name: amc
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes

Background

Section titled “Background”

Amcache.hve is a registry hive maintained by Windows Application Compatibility infrastructure. It tracks information about executed programs, installed applications, device drivers, and application shortcuts.

Amcache provides historical evidence of program execution and can contain information about programs that have been deleted. The format changed significantly between Windows 7/8 (old format with Root\File and Root\Programs keys) and Windows 10 (new format with Root\InventoryApplication* keys).

Data Collected

Section titled “Data Collected”

This collector gathers structured data about amcache.

AmCache Data

Section titled “AmCache Data”
FieldDescriptionExample
ProgramIDProgram identifier00001234567890abcdef
ProgramNameApplication nameGoogle Chrome
VersionApplication version118.0.5993.89
PublisherSoftware publisherGoogle LLC
RootDirPathInstallation directoryC:\Program Files\Google\Chrome
InstallDateInstallation date2023-10-01T10:00:00
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
PackageFullNameUWP package name
InstallSourceTypeInstallation source2
MSIProductCodeMSI product code GUID{12345678-1234-1234-1234-123456789ABC}
MSIPackageCodeMSI package code GUID{12345678-1234-1234-1234-123456789ABC}
UninstallKeyUninstall registry keySOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall…
UninstallStringUninstall command”C:\Program Files\App\uninstall.exe”
ProgramIDAssociated program ID00001234567890abcdef
FileIDFile identifier (SHA1)a1b2c3d4e5f6…
ProductNameProduct name from file metadataGoogle Chrome
ProductVersionProduct version118.0.5993.89
NameFile namechrome.exe
FilePathLowercase long pathc:\program files\google\chrome\application\chrome.exe
OriginalFileNameOriginal file name from PE headerchrome.exe
SHA1SHA1 hasha1b2c3d4e5f6…
PublisherPublisher nameGoogle LLC
FileSizeFile size in bytes3145728
USNUpdate Sequence Number123456789
IsOsComponentWhether file is OS componentFALSE
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
KeyNameRegistry key namechrome.lnk
LNKPathPath to shortcut fileC:\Users\user\Desktop\Chrome.lnk
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
KeyNameDevice identifierUSB\VID_1234&PID_5678
ClassDevice classUSB
DescriptionDevice descriptionUSB Mass Storage Device
DriverNameDriver nameusbstor.inf
DriverPackageStrongNameDriver package identifieroem12.inf:…
ModelDevice modelSanDisk Ultra
FirstInstallDateFirst installation date2023-09-01T12:00:00
InstallDateLast installation date2023-10-01T14:00:00
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
ManufacturerDevice manufacturerSanDisk
ProviderDriver providerMicrosoft
ServiceAssociated serviceUSBSTOR
DriverVerDateDriver version date2023-06-15T00:00:00
DriverVerVersionDriver version10.0.19041.1234
HWIDHardware IDUSB\VID_1234&PID_5678&REV_0100
InfINF file nameusbstor.inf
ParentIDParent device IDUSB\ROOT_HUB30
DriverIDDriver identifierusbstor.inf:…
ContainerIDContainer ID GUID{12345678-1234-1234-1234-123456789ABC}
ClassGuidClass GUID{36FC9E60-C465-11CF-8056-444553540000}
COMPIDCompatible IDsUSB\Class_08
BusReportedDescriptionBus-reported descriptionUSB Mass Storage Device
KeyNameDriver key namentfs.sys
ProductProduct nameMicrosoft Windows
ProductVersionProduct version10.0.19041.1234
DriverNameDriver file namentfs.sys
DriverVersionDriver version10.0.19041.1234
DriverPackageStrongNameDriver package identifieroem0.inf:…
DriverCompanyDriver companyMicrosoft Corporation
DriverLastWriteTimeDriver last write time2023-06-01T00:00:00
DriverTimeStampDriver timestamp2023-06-01T00:00:00
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
DriverIsKernelModeWhether driver is kernel-modeTRUE
DriverSignedWhether driver is signedTRUE
ServiceAssociated serviceNTFS
InfINF file namentfs.inf
DriverIdDriver identifierntfs.sys:…
DriverCheckSumDriver checksum0x12345678
ImageSizeDriver image size524288
VolumeIDVolume GUID{12345678-1234-1234-1234-123456789ABC}
FileIDFile entry identifier00001234abcd
ProgramIDAssociated program ID00005678efgh
ProductNameProduct nameGoogle Chrome
CompanyNameCompany nameGoogle LLC
FilePathFile pathC:\Program Files\Google\Chrome\Application\chrome.exe
FileDescriptionFile descriptionGoogle Chrome
FileVersionFile version118.0.5993.89
FileSizeFile size in bytes3145728
SHA1SHA1 hasha1b2c3d4e5f6…
CompilationTimePE compilation timestamp2023-09-15T10:00:00
FileModificationTimeFile modification time2023-09-20T14:00:00
FileCreationTimeFile creation time2023-10-01T12:00:00
EntryCreationTimeAmcache entry creation2023-10-01T12:05:00
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
MFTEntryNumberMFT entry number12345
MFTSequenceNumberMFT sequence number1
ProgramIDProgram identifier00005678efgh
VolumeIDFileIDSpace-separated list of file IDs00001234abcd 00005678ijkl
ProgramNameProgram nameGoogle Chrome
ProgramVersionProgram version118.0.5993.89
FilePathsSpace-separated file pathsC:\Program Files\Google\Chrome…
PublisherPublisher nameGoogle LLC
InstallDateInstallation date2023-10-01T10:00:00
KeyLastWriteTimeRegistry key modification time2023-10-15T14:30:00
InstallSourceTypeInstallation source type2
UninstallKeysUninstall registry keysSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall…
ProductCodeProduct code GUID{12345678-1234-1234-1234-123456789ABC}
PackageCodePackage code GUID{12345678-1234-1234-1234-123456789ABC}
MSIProductCodesMSI product codes{12345678-1234-1234-1234-123456789ABC}
MSIPackageCodesMSI package codes{12345678-1234-1234-1234-123456789ABC}

Collection Method

Section titled “Collection Method”

This collector:

  • Collects Windows\appcompat\Programs\Amcache.hve and transaction logs
  • Parses the offline registry hive using OfflineRegistry library
  • Detects format version (old vs new)
  • Extracts data from appropriate registry keys based on version

New Format Keys:

  • Root\InventoryApplication
  • Root\InventoryApplicationFile
  • Root\InventoryApplicationShortcut
  • Root\InventoryDevicePnp
  • Root\InventoryDriverBinary

Old Format Keys:

  • Root\File
  • Root\Programs

Forensic Value

Section titled “Forensic Value”

Amcache is invaluable for program execution analysis and historical application tracking. Investigators use this data to prove program execution (even deleted programs), establish installation timelines, identify malware execution, track application versions and updates, correlate file hashes with known malware, detect portable executable usage, and reconstruct user application usage patterns.