en

Windows AppCompatCache forensics

Parse the Windows Shimcache in your browser.

Drop a SYSTEM registry hive and instantly extract every AppCompatCache entry — file path, last-modified time, and OS format — without ever uploading the file.

  • Nothing is uploaded
  • Rust + WebAssembly parser
  • Windows XP to 11

Drop a SYSTEM hive here

or click to browse

Also accepts a ZIP triage collection (KAPE, Velociraptor…) or a whole folder

Synthetic SYSTEM hive from a fictional intrusion — no real data.

How to get your data

Never collected a SYSTEM hive? Pick the first method that fits: one command, then drop the file here.

  1. Collect the SYSTEM hive
  2. Drop the file, folder or ZIP here
  3. Parsed in your browser — nothing is uploaded

Run as administrator (right-click Command Prompt or PowerShell → Run as administrator). Built into Windows — nothing to install.

Command Prompt (admin)
mkdir C:\triage 2>nul & reg save HKLM\SYSTEM C:\triage\SYSTEM.hiv /y
PowerShell (admin)
New-Item -ItemType Directory -Force -Path C:\triage | Out-Null; reg.exe save HKLM\SYSTEM C:\triage\SYSTEM.hiv /y

Creates C:\triage\SYSTEM.hiv — drop that one file. reg save writes a clean, consistent copy of the live hive, so no transaction logs are needed.

Gotchas

  • The live SYSTEM file is locked: a plain copy fails, and some tools silently produce a zero-filled file. Use reg save or a raw-copy tool.
  • No log replay here: a raw copy of a live hive can miss recent writes. Replay SYSTEM.LOG1 / SYSTEM.LOG2 first, or use reg save.
  • Windows writes the cache to the registry only at shutdown or reboot: executions since the last boot exist only in memory (capture RAM, e.g. Volatility windows.shimcachemem).
Full acquisition guide →

Everything runs locally. Your hive never leaves this page.

What you get

Everything the ShimCache holds, without the tooling overhead

  • Every ControlSet

    ControlSet001, 002 and any others are parsed and tagged, with the active set marked, so entries that only survive in the backup set are not missed.

  • Windows XP to 11

    XP, Server 2003, Vista/7 (x86 and x64), 8, 8.1, 10 and 11 cache layouts are detected automatically.

  • Suspicion triage

    Known attacker tools and user-writable or staging paths are flagged, so the rows worth reading first stand out.

  • CSV and JSON export

    Take the filtered view into your timeline, spreadsheet or SIEM, with ControlSet and format on every row.

  • Triage collections

    Drop a KAPE or Velociraptor ZIP, or a whole folder: the SYSTEM hive and its RegBack copy are found for you, and anything that isn't one is explained. Transaction logs are reported, not replayed.

  • Private by design

    The Rust parser runs as WebAssembly inside your browser tab. Nothing is uploaded, logged or stored on a server.

How it works

From hive to timeline in three steps

  1. 01

    Collect the SYSTEM hive

    Copy C:\Windows\System32\config\SYSTEM with KAPE, FTK Imager or reg save, or take it from a mounted image.

  2. 02

    Drop it here

    The file is read locally and parsed by WebAssembly in a background worker, usually in well under a second.

  3. 03

    Triage and export

    Sort, filter and review the flagged paths, then export CSV or JSON for your case notes.

Related tools

Artifacts that answer the next question in the same case.

FAQ

Shimcache forensics — frequently asked questions

Quick answers to the questions investigators ask most when analyzing the Windows AppCompatCache.

What is the Windows ShimCache (AppCompatCache)?
The ShimCache, also called AppCompatCache, is a Windows feature that tracks executables the operating system has examined for application-compatibility shimming. It stores up to 1,024 entries per system, including the file path and last-modified timestamp. Investigators rely on it as evidence that a binary existed on a machine — even after the file has been deleted.
Does a ShimCache entry prove a program was executed?
No. ShimCache records files that Windows examined, which often (but not always) implies execution. On Windows 10 and 11 the in-cache execution flag was removed, so corroborating artifacts — Prefetch, AmCache, Security or Sysmon event logs — are required to confirm a program actually ran.
Why doesn't the ShimCache timestamp match when the program ran?
The displayed timestamp is the file's last-modified time ($STANDARD_INFORMATION), not the time of execution. A binary copied without timestamp changes will show its original mtime. Treat ShimCache as a 'program existence' artifact, not a 'program execution' timeline.
Can ShimCache entries be deleted or tampered with?
Yes. ShimCache is held in memory and only flushed to the SYSTEM hive on shutdown, so a hard reboot can lose recent entries. Anti-forensic tools and registry edits can also clear or modify it. Always corroborate findings with AmCache, Prefetch, and event-log evidence.
What is the difference between ShimCache and AmCache?
ShimCache lives in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache and stores up to 1,024 path + mtime entries. AmCache (Amcache.hve) is a separate database that tracks installed programs and recently executed files with SHA-1 hashes and far richer metadata. The two artifacts complement each other in forensic timelines.

Have a SYSTEM hive to hand?

Drop it in and see every executable Windows noted, in seconds, without the file leaving your machine.