Amcache.hve
A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.