Deep dives into the Windows AppCompatCache, AmCache, Prefetch, and the rest of the program-execution artifact landscape.
The AppCompatCache binary layout changed with almost every Windows release. This is a per-version reference to the older formats — XP, Server 2003, Vista/2008, Windows 7, and 8 — and the magic values that identify them.
Read article →Yes — and that's exactly why it matters. The ShimCache routinely retains entries for executables that no longer exist on disk. Here is why, how long they survive, and how to use deleted-file entries as evidence.
Read article →Remote-execution tooling leaves a recognizable ShimCache footprint on both source and destination hosts. This is a practical guide to using AppCompatCache to reconstruct lateral movement across a Windows estate.
Read article →The timestamp in a ShimCache entry is the file's last-modified time — not when the program ran. Here is exactly what the value is, why it misleads investigators, and how to use it correctly.
Read article →Prefetch records execution; ShimCache records that Windows examined a file. They answer different questions with different reliability. A practical head-to-head for investigators.
Read article →The ShimCache can be tampered with — but rarely cleanly. This post catalogs how attackers try to wipe or modify shimcache entries, and the forensic tells investigators can use to spot it.
Read article →Because the Windows ShimCache only flushes to the registry at shutdown, a memory dump often holds entries the on-disk hive doesn't. This guide covers extraction with Volatility and Velociraptor.
Read article →A timeline that fuses ShimCache, AmCache, Prefetch, and the SYSTEM hive's BAM data is the backbone of most Windows IR reports. This guide walks through assembling one end-to-end.
Read article →A practical workflow for using the Windows ShimCache to surface suspicious binaries during threat hunting and incident response — what to look for, how to triage hits, and how to corroborate them.
Read article →Ransomware actors routinely delete their tools, encrypt and wipe, and reboot to cover tracks. The ShimCache is one of the few artifacts that still answers basic questions after that. Here is how to use it.
Read article →A practical guide to extracting the Windows SYSTEM registry hive (and its transaction logs) for offline forensic analysis — from a dead disk, a live system, or a memory image.
Read article →Four open tools dominate offline ShimCache parsing — each with different strengths. A practical comparison for picking the right one for your workflow.
Read article →A side-by-side reference of the five Windows artifacts most useful for proving program execution — Prefetch, AmCache, ShimCache, UserAssist, BAM/DAM — with their reliability and limitations.
Read article →A ShimCache entry is regularly mistaken for proof that a binary ran. The truth is more nuanced — here is what the cache actually records, and how to confirm execution properly.
Read article →ShimCache and AmCache both surface program-execution evidence on Windows, but they record different things, on different schedules, with different reliability. A practical comparison for forensic investigators.
Read article →The Windows ShimCache lives in a single registry value but is only persisted at shutdown. Understanding its storage path and write timing changes how investigators handle volatile evidence.
Read article →A practical walk through the Windows 10 and 11 AppCompatCache binary layout — header bytes, per-entry magic, path encoding, and the offsets a parser needs to get right.
Read article →A practical primer on the Windows ShimCache — where it lives, what it records, and how forensic investigators use it to prove program existence.
Read article →