Blogs >> AmCache

Investigating AmCache

14/09/2021 Tuesday

AmCache.hve is a Windows system file that is created to store information related to program executions. The artifacts in this file can serve as a huge aid in an investigation, it records the processes recently run on the system and lists the paths of the files executed.


Digital Forensics Value of AmCache Artifacts


AmCache artifacts are important to investigations where the tracing of external storage devices, portable programs and anti-forensic programs might be required. The data contained in the file includes the execution paths, installation, execution, deletion times and more. It also stores the SHA1 hashes of the programs which can be used to compare against the hashes of malicious programs available in public database.


Location of AmCache Artifacts


AmCache.hve file is located at C:\Windows\appcompat\Programs\Amcache.hve


Structure of AmCache Artifacts


The AmCache.hve file is a registry hive file. The registry file format is a binary file analogous to a filesystem, with a group of keys, subkeys and values. These files are used by the operating system to store user, system, and application configurations.


Analyzing AmCache Artifacts with ArtiFast Windows


This section will discuss how to use ArtiFast Windows to extract AmCache artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifact Parser Selection Phase, you can select AmCache Artifacts:




ArtiFast can analyze AmCache application files, executed programs, driver binaries, Pnp devices, driver packages, device containers, and application shortcuts from Windows 10 systems. And executed files and programs from Windows 8.1 systems. For demonstration purposes all the artifacts have been chosen, however you have the option to select one or more artifacts.



Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via "Artifact View" or "Timeline View," with indexing, filtering, and searching capabilities. Below is a detailed description of AmCache artifacts in ArtiFast software.


AmCache Application Files Artifact

The artifact contains information on files used by executable programs. The details you can view include:


AmCache Application Programs Artifact

The artifact contains information on programs that have been executed on the system. The details you can view include:


AmCache Driver Binaries Artifact

The artifact contains information about driver binaries on the system, such as when they were signed, and services associated with them. The details you can view include:


AmCache Pnp Devices Artifact

The artifact contains information on plug and play devices connected to the system. The details you can view include:


AmCache Driver Packages Artifact

The artifact contains information on driver packages on the system. The details you can view include:


AmCache Device Containers Artifact

The artifact contains information on devices connected to the system. The details you can view include:


AmCache Application Shortcuts Artifact

The artifact contains information on programs and file shortcuts used on the system. The details you can view include:


In Windows version 8.1 ArtiFast parses 2 artifacts from the AmCache.hve file. AmCache files and programs artifacts which are explained in detail below.


AmCache Files Artifact

The artifact contains information on files used by executable programs. The details you can view include:


AmCache Programs Artifact

The artifact contains information on programs that have been executed on the system. The details you can view include: