Amcache.hve
A registry hive recording programs the system has encountered, and one of very few artifacts that stores a hash. When a binary has been deleted, the SHA-1 here is often the only way to identify what it was.
where it lives
C:\Windows\AppCompat\Programs\Amcache.hveInventoryApplicationFile holds the per-binary entries on Windows 10 and later.
what it proves
- A binary was present at a given path
- Its SHA-1, computed over the first 31.4 MB, which matters when you compare against a threat-intel hash of the whole file
- Compilation timestamp and file version metadata
- Frequently, the publisher and whether it was signed
what it does not prove
- Execution, despite being widely cited as an execution artifact. Presence is what it records
- A whole-file hash for anything over 31.4 MB
- Timing precise enough to sequence an intrusion on its own
parsing it
AmcacheParser (Eric Zimmerman)RegRipper
tampering and anti-forensics
The hive is large and actively written, so selective tampering is hard to do cleanly. Its presence of a hash for a file the attacker later deleted is the reason it is worth pulling early.
how long it survives
Long, often the full life of the installation.