Updated AMCache.md and added RecentFileCache.md

ForensicArtifacts · Feb 4, 2020 · 8f2da64 · 8f2da64
1 parent 0cdc994
commit 8f2da64
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/windows/AMCache.md b/windows/AMCache.md
@@ -1,7 +1,7 @@
 ## AMCache
 
-The AMCache is an stores metadata about program installation and execution on
-Windows.
+The AMCache is an stores metadata about program installation and execution for
+Windows Application Compatibility.
 
 It can be found on Windows 7 and Server 2008 R2 and later.
 
@@ -15,4 +15,5 @@ C:\Windows\AppCompat\Programs\Amcache.hve
 ### References
 
 * [ForensicsWiki: AMCache](https://forensicswiki.xyz/wiki/index.php?title=AMCache)
+* [ForensicsWiki: Windows Application Compatibility](https://forensicswiki.xyz/wiki/index.php?title=Windows_Application_Compatibility)
 * [Windows NT Registry File (REGF) format specification](https://github.com/libyal/libregf/blob/master/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc)
diff --git a/windows/RecentFileCache.md b/windows/RecentFileCache.md
@@ -0,0 +1,14 @@
+## Recent file cache
+
+The recent file cache is an stores metadata about program installation and
+execution for Windows Application Compatibility.
+
+It can be found on Windows 7.
+
+```
+C:\Windows\AppCompat\Programs\RecentFileCache.bcf
+```
+
+### References
+
+* [ForensicsWiki: Windows Application Compatibility](https://forensicswiki.xyz/wiki/index.php?title=Windows_Application_Compatibility)