Added AMCache.md

ForensicArtifacts · Feb 4, 2020 · 0cdc994 · 0cdc994
1 parent 1e9dbc1
commit 0cdc994
Showing 1 changed file with 18 additions and 0 deletions.
diff --git a/windows/AMCache.md b/windows/AMCache.md
@@ -0,0 +1,18 @@
+## AMCache
+
+The AMCache is an stores metadata about program installation and execution on
+Windows.
+
+It can be found on Windows 7 and Server 2008 R2 and later.
+
+The AMCache is stored in a Windows NT Registry File (REGF) format in a file
+named AMCache.hve.
+
+```
+C:\Windows\AppCompat\Programs\Amcache.hve 
+```
+
+### References
+
+* [ForensicsWiki: AMCache](https://forensicswiki.xyz/wiki/index.php?title=AMCache)
+* [Windows NT Registry File (REGF) format specification](https://github.com/libyal/libregf/blob/master/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc)