Amcache
Amcache.hve and databases
- 6 paths
Amcache.hveAmcache.hve.LOG**.db- Version 1.1
- Eric Zimmerman
Paths on disk
6 paths
References
8 links
- digital-forensics.sans.org/media/poster-windows-forensics-final.pdf(opens in new tab)
- youtube.com/watch?v=_DqTBYeQ8yA(opens in new tab)
- youtube.com/watch?v=-0bYcD3_bBs(opens in new tab)
- youtube.com/watch?v=iTchBtRr6TA(opens in new tab)
- andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/(opens in new tab)
- forensafe.com/blogs/amcache.html(opens in new tab)
- commons.erau.edu/cgi/viewcontent.cgi?article=1429&context=jdfsl(opens in new tab)
- thedfirspot.com/post/evidence-of-program-existence-amcache(opens in new tab)