Skip to main content

Artifacts
Collections
Builder
Converter

Navigate

Artifacts Collections Builder Converter

GitHub(opens in new tab)

Home
Artifacts
Windows
sdb

SDB

Shim SDB FIles

Windows
4 paths
*.sdb
Version 1
Troy Larson

Paths on disk

4 paths

References

2 links

geoffchappell.com/studies/windows/win32/apphelp/sdb/index.htm?tx=54(opens in new tab)
docs.microsoft.com/en-us/windows/win32/devnotes/application-compatibility-database?redirectedfrom=MSDN(opens in new tab)

Collect it

KAPE command line for SDB

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target SDB

Run with administrator privileges. KAPE Documentation

Source: KapeFiles/Windows/SDB.tkape(opens in new tab)

The comprehensive resource for Windows forensic artifacts. Search, explore, and generate collection scripts for DFIR investigations.

Navigate

All Artifacts Collections Script Builder Sigma Converter

Resources

GitHub(opens in new tab)KapeFiles(opens in new tab)KAPE Documentation(opens in new tab)SANS KAPE(opens in new tab)

© 2026 DFIRHub. Data sourced from KapeFiles