cyber-triage-logo

ShimCache and AmCache Forensic Analysis 2025

ShimCache and AmCache have lots to offer investigators.

But they’re tricky, too.

Learn the ins and outs of these artifacts from DFIR expert Chris Ray.

Let’s get to it!

Jump to…
Intro to ShimCache and AmCache
Understanding AmCache
Understanding ShimCache
Data Captured by AmCache
Data Captured by ShimCache
AmCache vs. ShimCache
Tools for Analysis
Other Application Compatibility Artifacts

Intro to ShimCache and AmCache 

The Windows Application Compatibility (Shim) Infrastructure is a complex and powerful feature that enables older applications to run on newer systems using a form of API hooking.

Metadata is stored on PE files of interest (executed, viewed by user, etc.) and installed applications to allow the shimming infrastructure to work smoothly. As a result, the locations where Windows stores this metadata became key forensic artifacts.

2 most notable: 

  • ShimCache
  • AmCache

From an investigator’s perspective, these artifacts provide a trove of information available by default on all modern systems. This is in contrast to other high-value artifacts like Prefetch (disabled by default on servers) and process auditing (disabled by default), which may not be available.

We will dive into each of these artifacts in the following section below.

But, at a high level, both artifacts provide the following:

Evidence Notes
Existence All entries can prove file once existed at recorded location.
Execution Due to the complex nature of these artifacts, it’s best to think of this data under evidence of existence rather than evidence of execution. In certain scenarios you can show a file executed with a high degree of confidence, but should never be the definitive proof that something ran.
App install AmCache only.

Understanding AmCache

AmCache is part of the Windows shimming infrastructure and was designed to enhance the application compatibility experience. The data is stored in a registry hive (REGF formatted file), which is not part of the Windows Registry. Amcache logs extensive metadata related to installed applications, programs that exist or have been executed, drivers loaded, and much more.

Location
Newer location 
C:\Windows\AppCompat\Programs\Amcache.hve
Older location* 
C:\AppCompat\Programs\RecentFileCache.bcf
Limitations to Keep in Mind
  • SHA1 hash isn’t always a full file hash (only up to 30 MBs).
  • Doesn’t contain process arguments, user associated with execution, or execution times.
  • Due to the artifact’s complexity, entries should generally not be used to prove program execution. Safer to interpret data as evidence of existence.**
  • Artifact is complex and has changed numerous times since its inception, making it difficult to understand and leverage all the data it has to offer.
Forensic Utility
  • Data can prove files existed on disk even after file deletion.
  • Provides insight into installed applications, along with how it was installed.
  • SHA1 hash for PE files and drivers allows for file reputation checks to be done even after files have been deleted.
  • Stores comprehensive metadata for PE files and DLLs such as file size, SHA1, and PE header info like CompanyName, FileVersion, etc.
Learn More about AmCache
Note
*Old version available generally old systems not updated like <= Win7. Main factor isn’t the OS version but the Windows libraries on the system. If they are version 6.1.x, this file will be present. The newer version will use the Amcache.hve location.
** True of AmCache hve programs and those in the older location.

Understanding ShimCache

ShimCache (Application Compatibility Cache) is a Windows feature designed to provide backward compatibility for older applications running on newer systems. The caching information is stored in memory and written to the registry upon system shutdown. Entries are generally added to the cache if the file was executed or visible in the Windows File Explorer.

Location
XP 
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache
Vista+: 
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Limitations to Keep in Mind
  • Records a max of 1024 entries.*
  • Doesn’t prove execution in Windows 10+.**
  • Doesn’t record execution time, historical information (run count), user, or arguments.
  • Resides in memory and is only written to Registry on proper system reboot/shutdown.***
Forensic Utility
  • Show file execution.****
  • Useful in triage phases to identify potential files of interest
  • Prove file existence on disk, including PE files from UNC paths and USB devices.
  • Proximity in cache position can be used to find other interesting files that may have been added around the same time
  • Can be used to provide insight into files that have potentially been moved or renamed as they will be re-shimmed with the new path but same File modification timestamp.
Learn More about ShimCache
Notes
* Windows XP records 96 and Windows 2003 records 512.
** Eric Zimmerman updated AppcompatCacheParser to determine if an entry was executed based on the last 4 bytes of an entry for Windows 10+.
*** You can use volatility3 to parse ShimCache from memory.
**** This is only possible on systems before Windows 10. Starting with Windows 10, if the last 4 bytes of an entry = 1, there is a high likelihood the entry was executed, but shouldn’t be used to prove execution on its own. You can read more about this approach here.

Data Captured by AmCache

Note
We focus on the latest version of AmCache.hve. For a detailed analysis of AmCache including all of the various versions and artifacts check out Blanche’s paper.
InventoryApplicationShortcut
Stores information about lnk files on the system. Entries do not indicate execution as a scheduled task (Microsoft Compatibility Appraiser) is used to periodically scan specific folders to find new entries.

Example Folders

C:\users\*\Desktop
C:\ProgramData\Microsoft\Windows\Start Menu\

Data Available

Example of InventoryApplicationShortcut content 
Example of InventoryApplicationShortcut content.
  • ShortcutPath: Path to LNK file.
  • ShortcutTargetPath: Path to target (what LNK file points to).
InventoryApplicationFile
Example of InventoryApplicationFile content.
Example of InventoryApplicationFile content.

Generally contains information about files that have been executed and needed to be shimmed, exes that exist in specific folders (scanned from scheduled task), or were put on the system from an application install.

  • ProgramId: ID used to map file back to installed applications under the InventoryApplication key.*
  • FileID: SHA1 hash of file (first 30MBs).
  • LowerCaseLongPath: Full file path on disk.
  • Size: File size in bytes.
  • BinaryType: Determine type of binary (32 vs 64 bit).
  • PE header Info if Available:
    • OriginalName
    • ProductName
    • BinFileVersion
    • BinProductVersion
    • LinkDateExecutable
Note
* Not all entries will map to an application.
InventoryApplication
Example of InventoryApplication content.
Example of InventoryApplication content.

Contains metadata about installed and uninstalled programs.

  • ProgramId: ID used to map associated exe/dlls put on disk from the install process under the InventoryApplicationFile key.
  • Source: How the application was installed.
    • MSI  = installed via MSI.
    • AppxPackage = New MSIX installer (usually from Microsoft Store).
    • AddRemoveProgram = Installed via exe.
  • Publisher: Company organization from Singing Certificate.
  • RootDirPath: Where the application was installed.
  • Name: Name of the application installed;
  • Version: Version of application installed.
InventoryDriverBinary
Example of InventoryDriverBinary content.
Example of InventoryDriverBinary content.

Contains metadata about installed Drivers and is updated via the Microsoft Compatibility Appraiser task.

  • Key Name: Full path to driver on disk.
  • DriverID: SHA1 hash (first 30 MBs).
  • DriverSigned: Value 1 means it’s signed.
  • DriverIsKernelMode: Value 1 means it’s a kernel driver.
  • Service: Windows service name.
  • Product: ProductName from PE header.
  • DriverLastWriteTime: Last time drive was updated.

Data Captured by ShimCache

Information Recorded
Example data parsed from Appcompatcache key.
Example data parsed from Appcompatcache key.
  • Absolute path to the executable: Indicates where file was on disk.
  • Last modified timestamp:  Modify timestamp of file. Can be used to create a timeline of activity for when the file existed on the system.
  • Cache Entry number: Cache location. Generally the lower the number the more recent the entry. Entries with close proximity generally indicate files added to the cache in relatively close proximity. This can help identify other files of interest.

AmCache vs. ShimCache

Feature AmCache ShimCache
Primary purpose Tracks certain PE files and installed apps (and other data). Tracks PE files ran or viewed in File Explorer.
When is data available Immediately. Some data will be in transaction logs. Updated at shutdown/reboot.
Key data Rich metadata: SHA1 hashes, paths, select PE header info, install dates, etc. Basic metadata: path, modified time, file size.
Location Amcache.hve registry hive. AppCompatCache registry entry.
Use cases Prove file existence, application installation, and driver install. Prove file existence and in certain situations execution.
Limitations Does not record all PE files. Size limitation.
Version-dependent schema changes make it difficult to understand. Only gets a view of activity before last shutdown unless looking in memory.
Does not record all PE files.

Tools for Analysis

AmCache Analysis Tools
Tool Creator Notes
AmcacheParser  Eric Zimmerman Only exports a targeted subset of data.
RegRipper3  Harlan Carvey Regripper plugin to parse PE files and installed apps.
Registry Explorer Eric ZImmerman Plugin modules parses most interesting Amcache keys.
ShimCache Analysis Tools
Tool Creator Notes
AppCompatCacheParser  Eric Zimmerman Only exports a targeted subset of data.
Volatility3 Aaron Walters Plugin to parse Shim cache entries from memory.
Cyber Triage Brian Carrier Parses shimcache entries that indicate execution and creates processes. Automatically timelined with other processes to get more context to verify actual execution.

Other Application Compatibility Artifacts

Other artifacts related to the Windows Application Compatibility infrastructure are:

Application Experience Event Logs PCA (Program Compatibility Assistance)

Blog