amcache proves a deleted exe once existed

the artifact that outlives the delete key

you can delete a file. you can empty the recycle bin. you can even wipe free space if you're feeling paranoid. and windows will still have a record that the file existed, what it was called, its hash, and roughly when it first showed up on your system. that record lives in amcache, and almost nobody checks it until they need it.

amcache is a hive file windows maintains to track application compatibility info. as a side effect, it becomes a quiet ledger of every executable the system has touched, including ones that are long gone. for defenders doing incident response on their own machines, or just trying to figure out "wait, did that sketchy installer actually run before i deleted it," this is one of the most useful artifacts you'll ever look at.

where it lives and why it matters

the hive sits at:

C:\Windows\AppCompat\Programs\Amcache.hve

it's a registry hive, so you can't just double click it and read it like a text file. it needs a parser that understands the structure. that's where a tool like AmcacheParser (part of eric zimmerman's forensic toolkit) comes in. it reads the hive and spits out clean, readable data: file paths, SHA-1 hashes, and first-seen timestamps, even for binaries that no longer exist on disk.

that last part is the whole point. malware, unauthorized tools, that "totally legit" crack you deleted five minutes after running it, amcache doesn't care that you cleaned up. the metadata already got written before the delete happened.

running the parser

AmcacheParser.exe -f C:\Windows\AppCompat\Programs\Amcache.hve --csv .

breaking this down:

-f points the tool at the amcache hive itself. you're telling it exactly which file to parse.

--csv . tells it to export the results as csv files into the current directory. amcacheparser will generate several csvs depending on what it finds, but the one most people care about is the "unassociated file entries" file, which covers binaries that ran but aren't neatly tied to an installed application.

run this on your own machine (as admin, since the hive is a protected system file) and you'll get a full inventory of executables your system has seen, going back further than you'd expect.

filtering the noise and pivoting the hash

a fresh windows install can generate thousands of amcache entries. you don't want to scroll through all of that by hand. this is where powershell earns its keep:

Import-Csv *_UnassociatedFileEntries.csv | ? Name -like '*suspect*' | fl Name,SHA1,FileKeyLastWriteTimestamp

Import-Csv loads the exported data back into powershell as objects you can actually query.

? Name -like '*suspect*' is shorthand for Where-Object, filtering down to filenames matching whatever you're hunting for. swap "suspect" for the actual filename, a partial match, or even a folder path fragment.

fl Name,SHA1,FileKeyLastWriteTimestamp formats the output as a list showing exactly three things: the filename, its hash, and the timestamp tied to that entry. that's your proof: what it was, what it hashed to, and roughly when it showed up.

once you have that sha1 hash, drop it into virustotal. if the hash comes back flagged, you now have confirmation that a malicious file existed on your system at a specific point in time, even though it's nowhere on disk anymore. that's the difference between "i think something happened" and "here's the hash and the timestamp."

the takeaway

amcache is easy to overlook because it's not something you interact with day to day. it just sits there quietly recording. but that's exactly why it's valuable for defense: if you suspect a compromise, a rogue install, or you're trying to reconstruct what happened on a machine after the fact, this hive doesn't lie and it doesn't get emptied when you hit delete.

check it periodically on systems you're responsible for. build a habit of pulling amcache during any incident response, not just as an afterthought. and if you're hardening a machine, know that this artifact is part of your evidence trail whether you plan for it or not, so use it. the deleted file thinks it got away. amcache remembers.