Study guide
11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist
Key Takeaways Explain This Topic AI
Windows Prefetch files (.pf) provide incontrovertible evidence of application execution, tracking up to 8 last execution timestamps (Win 10/11), run counts, volume metadata, and all secondary DLLs loaded during the initial 10 seconds of runtime.
Prefetch files use the naming standard [PROCNAME]-[CRC32].pf; Windows 10 and 11 utilize version 30/31 formats featuring proprietary MAM LZ77 compression.
Shimcache (AppCompatCache) stores execution metadata for up to 1,024 binaries in SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache ; it is held in csrss.exe memory during runtime and flushed to disk only on reboot or shutdown.
Amcache.hve is a dedicated registry hive located at %SystemRoot%\appcompat\Programs\Amcache.hve that records SHA-1 cryptographic file hashes, PE compile times, and full paths of executed binaries, persisting even after malware deletion.
UserAssist in NTUSER.DAT tracks GUI-based program execution using ROT13 encryption, while BAM/DAM in the SYSTEM hive records kernel-level execution timestamps linked directly to the executing user's SID.
Last updated: September 2026
11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist
Quick Answer: Proving program execution—rather than mere file presence—is critical in malware investigations and incident response. Windows records execution across multiple complementary artifacts: Prefetch files ( C:\Windows\Prefetch\*.pf ) record run count, up to 8 last execution timestamps (in Windows 10/11 versions 30/31, compressed with MAM LZ77 ), and all loaded DLLs within the first 10 seconds. Shimcache (AppCompatCache) in the SYSTEM hive tracks up to 1,024 binaries and their $STANDARD_INFORMATION Last Modified timestamps; it resides in csrss.exe memory during runtime and only flushes to disk upon clean shutdown. Amcache.hve provides the SHA-1 file hash of executed binaries and PE header compile dates, persisting even if the binary was deleted. Finally, UserAssist ( NTUSER.DAT ) captures GUI executions obfuscated via ROT13 , while BAM/DAM ( SYSTEM\...\Services\bam ) provides kernel-level execution timestamps mapped directly to the executing User SID.
Windows Program Execution Artifact Matrix
When investigating an intrusion, determining whether a malicious binary, script, or dual-use tool (e.g., mimikatz.exe , psexec.exe , powershell.exe ) actually executed is essential. Windows implements multiple subsystems that record execution data for memory management, application compatibility, and system optimization: +---------------------------------------------------------------------------------------------------------+
- | WINDOWS EXECUTION ARTIFACT COMPARISON |
- +---------------------------------------------------------------------------------------------------------+
- | Artifact | Storage Location | Exec Timestamps | Hash Recorded? | User Attributed? |
|-----------------|-------------------------------------|------------------|----------------|---------------------|
- | **Prefetch** | C:\Windows\Prefetch\*.pf | Up to 8 (Win10+) | No (CRC-32 Path)| No (System-wide) |
- | **Shimcache** | SYSTEM hive (AppCompatCache) | File Mod Time | No | No (System-wide) |
- | **Amcache** | C:\Windows\appcompat\Programs\... | First Exec/Install| SHA-1 Hash | No (System-wide) |
- | **UserAssist** | NTUSER.DAT (Explorer\UserAssist) | 1 Last Execution | No | Yes (Specific User) |
- | **BAM / DAM** | SYSTEM hive (Services\bam\State...) | 1 Last Execution | No | Yes (User SID) |
- +---------------------------------------------------------------------------------------------------------+
- Prefetch Forensics: SuperFetch, Formatting & Compression
The Windows Cache Manager and Task Scheduler monitor program launches through the SuperFetch (renamed SysMain in Windows 10) service. The primary architectural objective of Prefetching is to minimize disk latency by loading contiguous memory pages into RAM during the first 10 seconds of application execution.
Enablement and Configuration
Prefetch behavior is governed by the SYSTEM registry hive: SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher
0 = Disabled (often set by default on Windows Server platforms to reduce I/O).
1 = Application prefetching enabled (user programs only).
2 = Boot prefetching enabled (boot processes only).
3 = Both Application and Boot prefetching enabled (standard default on Windows client operating systems).
File Naming Convention & Path Hashing
Prefetch files reside in %SystemRoot%\Prefetch\ (typically C:\Windows\Prefetch\ ) and adhere to the strict naming convention: [EXECUTABLE_NAME]-[CRC32_HASH].pf Example: CMD.EXE-4A81B364.pf
- MIMIKATZ.EXE-B7A1C92E.pf
- SVCHOST.EXE-36A4F98E.pf
The name is constructed from the first 29 characters of the executable filename followed by an 8-character hexadecimal string.
The 8-character string is a CRC-32-based hash of the complete Unicode file path from which the binary was launched.
If the binary is launched with specific command-line switches (specifically /prefetch:1 through /prefetch:8 ), the switch parameter is factored into the hash algorithm. This is why multiple svchost.exe or dllhost.exe Prefetch files exist simultaneously on disk.
Forensic Utility: If CALC.EXE-A1B2C3D4.pf and CALC.EXE-E5F60718.pf both exist, the calculator executable was launched from two distinct directory paths (e.g., C:\Windows\System32\ versus a suspicious staging directory like C:\Users\Public\ ).
Version Progression and Header Formats
The binary layout of .pf files has evolved across Windows releases:
Version 17: Windows XP and Windows Server 2003 (stores 1 execution timestamp).
Version 23: Windows Vista and Windows 7 (stores 1 execution timestamp).
Version 26: Windows 8 and Windows 8.1 (stores 8 execution timestamps in a circular array).
Version 30: Windows 10 (Builds 1507, 1511) - incorporates MAM LZ77 compression ; stores 8 timestamps.
Version 31: Windows 10 (Build 1607+) and Windows 11 - incorporates MAM LZ77 compression ; stores 8 timestamps.
MAM LZ77 Compression Mechanics
Prefetch files on Windows 10 and Windows 11 are compressed using a proprietary variant of the LZ77 compression algorithm.
When viewing raw bytes in a hex editor, a compressed .pf file begins with the ASCII magic header bytes: 0x4D 0x41 0x4D 0x04 ( MAM\x04 ).
Following the 4-byte signature is a 4-byte uncompressed file size field followed by the raw LZ77-compressed data streams.
Forensic parsing utilities (e.g., Eric Zimmerman's PECmd ) automatically decompress the MAM stream in memory before parsing the underlying Version 30/31 binary structure.
Evidentiary Values Extracted from Prefetch
When fully parsed, a Prefetch file reveals four critical forensic dimensions:
Run Count: Total number of times the executable has been run on that system.
Execution Timestamps (Up to 8): Windows 10/11 maintains an array of the last 8 execution dates and times (in 64-bit UTC FILETIME). The most recent execution corresponds to index 0.
Volume Information: Serial number, volume creation date, and directory path of the storage volume hosting the executable.
Loaded File and Directory Dependencies: An exhaustive list of every dynamic-link library ( .dll ), configuration file, icon, and directory accessed by the executable during its first 10 seconds of runtime. # Example PECmd Analysis Command Line
PECmd.exe -f "C:\Windows\Prefetch\CMD.EXE-4A81B364.pf" --json "C:\forensic_temp\"
Tip
Dependency listing is invaluable when investigating "Living off the Land" (LotL) attacks. If an attacker uses rundll32.exe , parsing RUNDLL32.EXE-[HASH].pf reveals the exact malicious DLL loaded from the file dependency block, exposing malware that would otherwise blend into native Windows processes.
Shimcache (AppCompatCache) Forensics
The Application Compatibility Cache (Shimcache) , internally designated as AppCompatCache , is part of the Microsoft Windows Application Compatibility infrastructure. Microsoft introduced shimming to allow older legacy applications to execute on newer Windows kernels without code refactoring.
Location and Volatile Architecture
Registry Key: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache (or SYSTEM\CurrentControlSet\Control\Session Manager\Environment on older systems).
The In-Memory Caching Dilemma: During normal operating system execution, the active Shimcache is held exclusively in the volatile memory space of the Client/Server Runtime Subsystem ( csrss.exe ) .
Updates are not written to the SYSTEM registry hive in real time.
The in-memory cache is committed and flushed to the SYSTEM hive on disk only upon a clean system reboot or controlled shutdown .
Forensic Implication: If an investigator seizes a live machine and immediately pulls the power cord (hard shutdown), all executions that occurred during that active session will be absent from the on-disk SYSTEM hive. In such cases, Shimcache must be extracted from volatile RAM dumps using tools like Volatility ( vol.py -f mem.raw windows.shimcache ).
Binary Format & Timestamp Characteristics
Shimcache records up to 1,024 entries on modern Windows endpoints. For each binary, it tracks:
Full Path: Absolute file system path to the executable.
File Size: Size of the file in bytes.
$STANDARD_INFORMATION Last Modified Timestamp:
Important
A common forensic mistake is assuming the timestamp in Shimcache represents the execution time . It does not. The timestamp recorded in Shimcache is the $STANDARD_INFORMATION Last Modified timestamp of the target executable at the moment it was examined by the AppCompat engine.
Execution Flag:
In Windows 7 , a discrete 1-byte flag ( 0x01 = Executed, 0x00 = Not executed/Cataloged) proved execution.
In Windows 8, 10, and 11 , the execution flag was removed. However, research proves that in Windows 10/11, entries are placed in Shimcache only when an execution attempt occurs. The entries are ordered chronologically from top to bottom (most recent at the top) , providing an execution timeline sequence. # Example AppCompatCacheParser Command Line
- AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Export" --dt "yyyy-MM-dd HH:mm:ss"
- Amcache ( Amcache.hve ) Forensics: The Cryptographic Hash Repository
Windows 8 introduced Amcache.hve as the architectural successor to RecentFileCache.bcf . It is one of the most powerful execution artifacts available because it captures cryptographic file hashes of executed programs.
File Location & Hive Format
Amcache.hve is located in %SystemRoot%\appcompat\Programs\Amcache.hve .
Structurally, Amcache.hve is a standard Windows Registry hive. It can be opened with hive viewers or parsed using automated forensic tools.
It has companion transaction logs: Amcache.hve.LOG1 and Amcache.hve.LOG2 , which must be merged for complete analysis.
Forensic Significance: SHA-1 Hashing
When a binary executes, Windows inspects the executable to determine if application shims are required. As part of this process, the OS calculates and stores the SHA-1 cryptographic hash of the first 30 MB of the binary. Amcache.hve (Root)
- └── Root
- └── File\<Volume GUID>\<File Reference ID>
- ├── 100 : Target Executable Full Path
- ├── 101 : SHA-1 Hash (Prefixed with 0000)
- ├── 102 : File Size
- ├── f : PE Compile TimeDateStamp
- └── 15 : First Execution / Installation Timestamp
- Crucial Metadata Extracted from Amcache
SHA-1 Hash: Enables immediate, retrospective threat intelligence queries against VirusTotal, MalwareBazaar, and internal SIEMs, even if the adversary wiped the malicious binary from the hard drive.
PE Header Compile Timestamp ( TimeDateStamp ): Reveals when the binary was compiled by the developer, assisting in campaign attribution and identifying stomped/manipulated headers.
Full File Path & Drive Association: Proves where the malware was staged.
Application Metadata: Product name, internal company name, file version, and file description extracted from the binary's version information resource block. # Parsing Amcache with Eric Zimmerman's AmcacheParser
- AmcacheParser.exe -f "C:\Windows\appcompat\Programs\Amcache.hve" --csv "C:\Cases\Amcache_Output"
- UserAssist Forensics: Interactive GUI Executions
While Prefetch, Shimcache, and Amcache provide system-wide execution tracking, UserAssist links program execution directly to a specific interactive user account .
Registry Keys & ROT13 Encryption
UserAssist keys reside within each user's profile hive: %UserProfile%\NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
Microsoft utilizes the ROT13 Caesar substitution cipher (rotating characters by 13 positions) to obfuscate subkey value names. For example, P:\Jvaqbjf\flfgrz32\pzq.rkr translates to C:\Windows\system32\cmd.exe . +-------------------------------------------------------------------------+
- | USERASSIST GUID IDENTIFIERS |
- +-------------------------------------------------------------------------+
- | GUID | Scope of Artifact Tracked |
- |---------------------------------------|---------------------------------|
- | {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}| Executable Applications (.exe) |
- | {F4E57C4B-2038-45F0-AE0E-A58D0F716EBF}| Shortcuts (.lnk) & UWP Apps |
- +-------------------------------------------------------------------------+
- The UserAssist Binary Data Structure (72 Bytes in Win 7/10/11)
The binary value associated with each ROT13-encoded application name contains 72 bytes of rich behavioral telemetry: +-------------------------------------------------------------------------+
- | USERASSIST BINARY DATA STRUCTURE (72 BYTES) |
- +-------------------------------------------------------------------------+
- | Offset | Data Type | Forensic Metric Tracked |
- |-------------|-----------|-----------------------------------------------|
- | 0x04 - 0x07 | 32-bit int| Total Execution (Run) Count |
- | 0x08 - 0x0B | 32-bit int| Application Focus Count (Number of times user |
- | | | brought the window to the foreground) |
- | 0x0C - 0x0F | 32-bit int| Total Focus Time (Active interactive duration |
- | | | in milliseconds) |
- | 0x3C - 0x43 | 64-bit int| Last Execution Timestamp (Windows FILETIME) |
- +-------------------------------------------------------------------------+
- Investigative Value and Constraints
GUI Execution Specificity: UserAssist tracks executions initiated through the Windows Explorer Graphical User Interface (e.g., double-clicking a desktop icon, launching from the Start Menu, or running via File Explorer).
Limitation: Executions spawned purely from the command line (CLI), batch scripts, PowerShell sessions, or scheduled tasks/services do not generate UserAssist entries .
BAM & DAM (Background & Desktop Activity Moderator)
Introduced in Windows 10 Fall Creators Update (Version 1709) , the Background Activity Moderator (BAM) and Desktop Activity Moderator (DAM) are kernel-mode drivers ( bam.sys , dam.sys ) deployed to optimize battery and process utilization.
- Registry Key Paths
- SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<User_SID>
- SYSTEM\CurrentControlSet\Services\dam\State\UserSettings\<User_SID>
- Forensic Utility
Each entry under the user's SID subkey represents an executable with its full file path.
The registry value data contains a single 64-bit Windows FILETIME timestamp representing the exact date and time the executable was last run .
Attribution Advantage: BAM/DAM records executions at the kernel level and maps the execution directly to the executing user's Security Identifier (SID) , successfully bridging the gap between system-wide artifacts (Prefetch/Shimcache) and user attribution.