Amcache is a Windows artefact that records details about executed programs and related file metadata. Investigators use it to identify software that has run on a system and to support timelines for execution and installation. Because its contents vary by version and context, it should be corroborated with logs, file metadata, and other host artefacts.
What Amcache is recording under the hood
Amcache is a Windows artefact, not a live security control. It exists because Windows keeps local evidence about software execution and file activity so investigators can later reconstruct what ran, when it appeared, and how it relates to the host state. That makes it most useful as a post-incident source of execution history, not as a standalone source of truth.
The value of Amcache is in the relationship between a program and the system that observed it. It can preserve file metadata that helps answer practical questions such as whether a binary was executed, whether it was recently introduced, and whether it matches other host artefacts. The exact fields and retention behaviour vary by Windows version and system context, so analysts treat it as one piece of a broader evidence set.
Because Amcache is derived from host activity, it is best understood as a timeline aid. It often supports questions about first-seen execution, program path, hash-related correlation, and changes in software presence across time. That is why it is commonly paired with registry artefacts, Prefetch, event logs, and filesystem metadata rather than interpreted in isolation.
How investigators use Amcache in an exam
In practice, Amcache helps answer “what was run here?” and “what was present here?” when a host is under scrutiny. Investigators use it to spot recently executed programs, identify tools that may have been staged or launched, and compare those records against other artefacts to confirm whether activity is consistent with normal administration or suspicious execution.
It is especially helpful when the live system is gone, altered, or only partially preserved. If an attacker cleaned up obvious traces, Amcache may still retain older execution-related metadata that can be correlated with disk artefacts, registry records, and log data. Digital Forensics (DFIR) Guide covers the evidence-handling and timeline-building context where artefacts like Amcache fit best.
Analysts should read Amcache conservatively. A record may suggest that software was executed or introduced, but the artefact alone does not prove user intent, maliciousness, or exact runtime behaviour. The strongest conclusions come from agreement across multiple host artefacts, especially when file timestamps, execution artefacts, and log activity line up.
Why Amcache must be corroborated
Amcache is valuable because it is durable and forensic, but it is not complete. Its contents can differ across Windows builds, installation patterns, and system activity, which means gaps are normal. A missing entry does not necessarily mean a program was never run, and a present entry does not automatically mean the program was malicious.
The main failure mode is overconfidence in a single artefact. If an investigator uses Amcache without corroboration, they can misread benign software as suspicious, miss short-lived tools, or infer execution where only file presence is documented. Good practice is to compare it with timestamps, logs, Prefetch where available, registry artefacts, and known host baselines before making an evidentiary claim.
Amcache is also useful for scoping compromise. When a suspicious binary appears, the artefact can help determine whether the same file family was introduced elsewhere on the host or whether execution appears isolated to a particular time window. That makes it a practical pivot point for broader triage, not just a catalog of filenames.
Risk and Threat Considerations
Amcache matters because attackers benefit when defenders do not preserve or compare host artefacts. If the artefact is unavailable, incomplete, or read without context, suspicious execution can be missed or misattributed, especially on systems where cleanup activity or short-lived tooling reduces other traces.
Failure mechanism: Adversaries can run tools briefly, remove obvious files, or blend into normal software activity while leaving only partial execution evidence behind. If investigators treat Amcache as definitive on its own, they can miss the surrounding attack chain or overstate what the artefact proves.
Impact: The result can be delayed detection, incomplete scoping, and weak incident reconstruction. In a forensic workflow, that can affect whether responders identify the full set of executed tools, accurately place activity on a timeline, or recognize follow-on compromise on the same host.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Amcache supports ongoing host visibility and detection of executed software. |
| Recommendation — Correlate Amcache with host monitoring to detect unexpected execution. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Amcache is forensic evidence that must be analyzed alongside other audit data. |
| Recommendation — Review Amcache entries with logs and timelines to validate host activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Amcache complements log review by preserving execution-related host evidence. |
| Recommendation — Preserve and review host evidence sources together to improve incident reconstruction. | ||
| MITRE ATT&CK | T1082 — System Information Discovery | Execution and software discovery artefacts help identify what was present on a host. |
| Recommendation — Map discovered software artefacts to host activity and investigate anomalies. | ||
Practitioner Guidance
What to verify: Treat Amcache as a corroboration source. Verify the record against at least one execution artefact and one file or timeline source before using it to support a conclusion about program launch or installation.
What good looks like: A strong analysis ties Amcache entries to matching file metadata, logs, and host timeline evidence, with clear notes on what the artefact proves and what it only suggests. That prevents overclaiming from a single Windows artefact.
Practitioner takeaway: Use Amcache to narrow the question, then use other host evidence to prove the answer; its strength is correlation, not standalone certainty.