has moved to this site, For information, please join the Google Group forensicswiki-reborn


From Forensics Wiki
Jump to navigation Jump to search

The AMCache is an stores metadata about program installation and execution on Windows.

It can be found on Windows 7 and Server 2008 R2 and later.

The AMCache is stored in the Windows NT Registry File (REGF) format in a file named AMCache.hve.

See Also