Amcache.hve
Definition
A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- Artifact type
- Windows registry hive
- Records
- Application install and execution metadata
- Includes
- SHA-1 hash of executables
- Persistence
- Survives deletion of the original file
Common questions
How does Amcache differ from Prefetch or ShimCache for proving execution?+
Prefetch and ShimCache mainly log that a file ran or was referenced, while Amcache additionally captures the file's SHA-1 hash and install path, letting an examiner tie a specific execution record to a specific binary even after the file itself is gone from disk.
Why is the SHA-1 hash in Amcache especially valuable evidentially?+
It lets an investigator match the executed program against known-malicious hash databases or a hash recovered from another source, providing stronger identity evidence than a filename alone, which can be easily changed or duplicated.
Related terms
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.