Amcache vs. Shimcache

Attribute	Amcache	Shimcache
File location	Located in the Windows\appcompat\Programs folder	Located in the Windows\System32\config folder
Purpose	Stores information about executed programs	Stores information about executed programs for compatibility purposes
Operating System	Introduced in Windows 8	Introduced in Windows XP
Storage format	SQLite database	Binary format

Introduction

When it comes to forensic analysis of Windows systems, two important artifacts that are often examined are the Amcache and Shimcache. These artifacts provide valuable information about the execution of programs on a system, helping investigators understand the activities that have taken place. While both Amcache and Shimcache serve similar purposes, they have distinct attributes that set them apart. In this article, we will compare the attributes of Amcache and Shimcache to highlight their differences and similarities.

Amcache

Amcache, short for "Application Compatibility Cache," is a Windows artifact that stores information about applications that have been executed on a system. This cache is maintained by the Windows operating system and is used to improve the performance of applications by storing information about their compatibility with the system. The Amcache contains details such as file paths, file sizes, timestamps, and digital signatures of executables that have been run on the system. This information can be valuable for forensic investigators to track the execution of programs and identify potentially malicious activities.

• Stores information about applications executed on the system
• Contains file paths, file sizes, timestamps, and digital signatures
• Maintained by the Windows operating system
• Used to improve application performance
• Valuable for forensic analysis to track program execution

Shimcache

Shimcache, short for "Application Compatibility Shim Cache," is another Windows artifact that records information about programs that have been executed on a system. Unlike Amcache, Shimcache stores this information in the Windows registry, specifically in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache. The Shimcache contains details such as file paths, last modified timestamps, and execution flags of programs that have been run on the system. This information can be useful for forensic investigators to identify suspicious or unauthorized activities on a system.

• Records information about executed programs in the Windows registry
• Stored in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
• Contains file paths, last modified timestamps, and execution flags
• Useful for identifying suspicious activities on a system
• Complements the information provided by Amcache

Comparison

While both Amcache and Shimcache serve the purpose of recording information about executed programs on a Windows system, they have some key differences in terms of storage location and the type of information they store. Amcache is maintained by the Windows operating system and stores information about applications in a dedicated cache file, while Shimcache stores its data in the Windows registry. Additionally, Amcache contains more detailed information about executables, including file sizes and digital signatures, whereas Shimcache focuses on file paths, timestamps, and execution flags.

• Amcache is maintained by the Windows operating system, while Shimcache stores data in the registry
• Amcache provides detailed information about executables, including file sizes and digital signatures
• Shimcache focuses on file paths, timestamps, and execution flags of programs
• Amcache and Shimcache complement each other in forensic analysis

Similarities

Despite their differences, Amcache and Shimcache share some similarities in terms of their purpose and utility in forensic analysis. Both artifacts provide valuable information about the execution of programs on a system, helping investigators track the activities that have taken place. They can be used to identify suspicious or unauthorized activities, as well as to understand the behavior of applications on a system. By analyzing both Amcache and Shimcache, forensic investigators can gain a comprehensive view of the programs that have been run on a Windows system.

• Both artifacts provide information about program execution on a system
• Help investigators track activities and identify suspicious behavior
• Useful for understanding application behavior on a system
• Comprehensive analysis requires examining both Amcache and Shimcache

Conclusion

In conclusion, Amcache and Shimcache are two important artifacts in Windows forensic analysis that provide valuable information about the execution of programs on a system. While they have distinct attributes in terms of storage location and the type of information they store, they serve a similar purpose of helping investigators track activities and identify suspicious behavior. By analyzing both Amcache and Shimcache, forensic investigators can gain a comprehensive view of the programs that have been run on a Windows system, enabling them to conduct thorough investigations and uncover potential security incidents.