Shimcache (AppCompatCache)
The Application Compatibility Cache records executables Windows has evaluated for shimming. It is the single most misread artifact in Windows forensics: an entry means the file was seen, not that it ran.
where it lives
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCacheThe hive is only written to disk at shutdown, so the newest entries may exist solely in memory on a running host.
what it proves
- A file existed at that full path
- Its last-modified timestamp at the moment Windows recorded it
- That Windows evaluated it, commonly on execution but also on a directory listing in Explorer
what it does not prove
- EXECUTION. This is the mistake to avoid. On Windows 10 and 11 there is no execution flag at all, and even on Windows 7 the flag was unreliable
- When it ran. The timestamp is the file's last-modified time, not an execution time
- Who was logged on
- Anything about a file whose entry has been pushed out; the cache holds 1024 entries
parsing it
AppCompatCacheParser (Eric Zimmerman)RegRipperVolatility (from a memory image, which captures entries not yet flushed)
tampering and anti-forensics
Because the cache is only flushed at shutdown, an attacker who forces a crash or pulls power can lose the most recent entries. Conversely, imaging memory on a live host recovers what the disk hive does not yet have.
how long it survives
Until pushed out by the 1024-entry cap, which on a busy host can be days.