Parsing Windows Prefetch & Shimcache for Executable Execution History

1. The Critical Role of Execution Artifacts in Digital Forensics

In digital forensics and incident response (DFIR) investigations—spanning corporate trade secret theft, unauthorized external data exfiltration, employee misconduct, and ransomware intrusion analysis—proving whether a specific application was executed is often the central question of liability. When an insider copies proprietary source code or confidential customer databases to a USB thumb drive, they frequently execute specialized archiving tools (e.g., 7z.exe, WinRAR.exe), anti-forensic wiping utilities (e.g., CCleaner.exe, BleachBit.exe, sdelete.exe), or cloud synchronization agents.

Because sophisticated actors often delete the executable file immediately after completing their malicious activity, forensic examiners cannot rely solely on standard file system directory listings. Instead, investigators rely on core Windows operating system artifacts designed for performance optimization and application compatibility:

• Windows Prefetch (.pf files): Designed to optimize application startup performance by caching contiguous disk sectors and loaded DLL dependencies during the first 10 seconds of program execution.
• Application Compatibility Cache (Shimcache / AppCompatCache): Maintained by the Windows kernel to track application compatibility flags across operating system upgrades and software patches.
• Amcache.hve: A dedicated registry hive (C:\Windows\AppCompat\Programs\Amcache.hve) that records extensive metadata about installed applications, uninstalled binaries, SHA-1 cryptographic file hashes, and compilation timestamps.
• UserAssist & Shellbags: NTUSER.DAT registry keys that record graphical user interface (GUI) application execution and folder navigation history.
• Background Activity Moderator (BAM) & Desktop Activity Moderator (DAM): System registry artifacts introduced in Windows 10 (stored under SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}) that record full path and precise 64-bit FILETIME execution timestamps for every user-launched process to manage power consumption.

When combined, these complementary forensic artifacts allow investigators to reconstruct a comprehensive timeline of digital activity. Even if an employee wipes their user profile or utilizes anti-forensic cleaning software, deep forensic traces persist across kernel registries, shadow copies, and raw NTFS unallocated clusters.

+---------------------------------------------------------------------------------------------------+
|                        WINDOWS EXECUTION ARTIFACT FORENSIC CORRELATION                            |
+---------------------------------------------------------------------------------------------------+
| 1. PREFETCH (.PF FILES IN C:\WINDOWS\PREFETCH):                                                   |
|   ├── Evidence: Run Count, Last 8 Execution Timestamps (Win 10/11), Loaded DLLs/Files.            |
|   └── Evidentiary Value: Conclusive Proof of Execution.                                            |
+---------------------------------------------------------------------------------------------------+
                                            +
+---------------------------------------------------------------------------------------------------+
| 2. SHIMCACHE (SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache):                  |
|   ├── Evidence: Full Path, File Size, Last Modified Time, Execution Flag (Win 7/8).               |
|   └── Evidentiary Value: Proof of File Presence & Compatibility Evaluation (Even from USB).       |
+---------------------------------------------------------------------------------------------------+
                                            +
+---------------------------------------------------------------------------------------------------+
| 3. AMCACHE.HVE (C:\Windows\AppCompat\Programs\Amcache.hve):                                      |
|   ├── Evidence: Program Name, File Path, SHA-1 Hash, PE Compilation Timestamp, Install Date.     |
|   └── Evidentiary Value: Cryptographic Identification of Uninstalled or Deleted Binaries.       |
+---------------------------------------------------------------------------------------------------+

Comparison Matrix: Windows Execution Artifacts

For more insights on digital evidence collection and registry forensics, explore our guides on USB Device Connection History Extraction from Windows Registry and SHA-256 Cryptographic Hashing & Digital Chain of Custody Standards.

2. Deep Dive: Windows Prefetch (.pf) Architecture

Windows Prefetch files are created when an application is launched. The operating system monitors page faults during the initial 10 seconds of execution and writes a corresponding .pf file to C:\Windows\Prefetch. The filename follows a standardized format: [EXECUTABLE_NAME]-[HASH].pf (e.g., CMD.EXE-AC10D70A.pf).

1. MAM Compression in Windows 10 and 11

Starting with Windows 10, Microsoft introduced proprietary header compression known as MAM compression (XPRESS Huffman / LZNT1 algorithm). A compressed Prefetch file begins with the 4-byte magic header MAM\x04 (0x044D414D). Forensic tools must decompress the byte stream using native Windows APIs (RtlDecompressBufferEx) or open-source parsers before inspecting internal structures.

2. Prefetch File Versioning Across Windows Releases

• Version 17 (Windows XP / 2003): Stores 1 execution timestamp and basic file metrics.
• Version 23 (Windows Vista / 7): Stores 1 execution timestamp, volume information, and loaded file references.
• Version 26 (Windows 8 / 8.1): Expanded to store up to 8 historical execution timestamps.
• Version 30 & 31 (Windows 10 / 11): Encapsulated inside MAM compression, storing 8 execution timestamps, run count, execution flags, volume serial numbers, and comprehensive dependency file arrays.

3. The Prefetch Hash Calculation Algorithm

The 8-character hexadecimal hash in the Prefetch filename is calculated using a proprietary hashing algorithm based on the full file path. On Windows Vista through Windows 11, the algorithm hashes the Unicode file path string with specific bitwise rotations. Because the hash incorporates the directory path, if an attacker executes cmd.exe from C:\Windows\System32 vs. a rogue cmd.exe from C:\Users\John\AppData\Local\Temp, two distinct Prefetch files with unique hashes will be generated.

Furthermore, when an executable is launched with specific command-line arguments (such as svchost.exe -k netsvcs or dllhost.exe /Processid:{...}), Windows computes specialized hashes incorporating both the binary path and command-line flags. This allows forensic examiners to distinguish standard background operating system processes from attacker-spawned interactive service hosts.

3. Advanced Shimcache & Amcache Parsing Methodologies

While Prefetch files provide conclusive execution proof, they may be disabled on Windows Server environments or SSD-configured systems. In such cases, Shimcache and Amcache become the primary artifacts for proving program presence and execution history.

1. The Shimcache (AppCompatCache) Lifecycle

The Shimcache artifact resides in the SYSTEM registry hive under the key SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache. Key technical characteristics include:

• In-Memory Caching: During active system runtime, Shimcache updates are held exclusively in kernel memory. The registry key on disk is only written upon clean system shutdown or restart.
• Volatile Memory Extraction: If an investigator acquires a live RAM dump, the current Shimcache entries can be extracted directly from memory using tools like Volatility 3 (windows.shimcache).
• Removable Media Tracking: When an executable stored on a USB thumb drive is inserted and accessed, Shimcache records the file path (e.g., E:\MaliciousTools\mimikatz.exe) and file modification date, proving the presence of hacking tools even after the USB drive is unplugged.
• Execution Flag Analysis (Windows 7/8 vs. 10/11): On Windows 7, the AppCompatCache table maintained a binary flag explicitly indicating execution (0x02). On Windows 10 and 11, while the flag format changed, the presence of a file entry within the cache proves that the file was accessed, parsed, or executed by the Windows sub-system.

2. Amcache.hve: The Crown Jewel of Forensic Attribution

Located at C:\Windows\AppCompat\Programs\Amcache.hve, this dedicated registry hive is parsed to extract rich forensic telemetry:

1. Cryptographic SHA-1 File Hashes: Amcache computes and stores the SHA-1 hash of the first 30MB of executed binaries, allowing examiners to identify malware even if the attacker renamed the executable to svchost.exe.
2. PE Compilation Timestamps: Reveals when the binary was compiled by the software developer, exposing custom-crafted malware.
3. File Size & Linker Information: Captures exact byte counts and compiler linker versions to cross-reference against known threat intelligence databases.
4. Installed Application Inventories: Maps full installation paths, uninstall strings, MSI product codes, and software publisher signatures across the entire system lifecycle.

4. Production Python Prefetch & Shimcache Extraction Engine

Below is a production-grade Python script that parses decompressed Windows Prefetch headers and correlates execution counts, timestamps, and volume paths into a structured forensic audit report:

import struct
import json
from datetime import datetime, timezone, timedelta
from dataclasses import dataclass, asdict
from typing import List, Dict, Optional

@dataclass
class PrefetchMetadata:
    executable_name: str
    prefetch_hash: str
    run_count: int
    last_execution_utc: str
    previous_executions: List[str]
    volume_serial_number: str
    file_references_count: int
    is_suspicious_location: bool

class WindowsPrefetchParser:
    def __init__(self):
        self.windows_epoch = datetime(1601, 1, 1, tzinfo=timezone.utc)

    def filetime_to_iso(self, filetime: int) -> Optional[str]:
        if filetime == 0:
            return None
        try:
            dt = self.windows_epoch + timedelta(microseconds=filetime / 10)
            return dt.strftime("%Y-%m-%dT%H:%M:%SZ")
        except (OverflowError, OSError):
            return None

    def parse_win10_raw_header(self, data: bytes, filename: str) -> PrefetchMetadata:
        # Verify Version 30 (0x1E) or Version 31 (0x1F)
        version = struct.unpack("<I", data[0:4])[0]
        exec_name = data[16:76].decode("utf-16le", errors="ignore").split("\x00")[0]
        pf_hash = f"{struct.unpack('<I', data[76:80])[0]:08X}"

        # Parse Execution Timestamps (8 slots on Win10/11)
        exec_times = []
        for i in range(8):
            offset = 84 + (i * 8)
            ft = struct.unpack("<Q", data[offset:offset+8])[0]
            iso = self.filetime_to_iso(ft)
            if iso:
                exec_times.append(iso)

        run_count = struct.unpack("<I", data[152:156])[0]
        vol_serial = f"{struct.unpack('<I', data[148:152])[0]:08X}"
        file_ref_count = struct.unpack("<I", data[156:160])[0]

        suspicious = any(s in filename.upper() for s in ["TEMP", "APPDATA", "DOWNLOADS", "CCLEANER", "SDELETE"])

        return PrefetchMetadata(
            executable_name=exec_name,
            prefetch_hash=pf_hash,
            run_count=run_count,
            last_execution_utc=exec_times[0] if exec_times else "UNKNOWN",
            previous_executions=exec_times[1:],
            volume_serial_number=vol_serial,
            file_references_count=file_ref_count,
            is_suspicious_location=suspicious
        )

# Production Verification Demonstration
if __name__ == "__main__":
    # Simulated 200-byte Decompressed Prefetch Header for CCLEANER.EXE-A4B7D89C.pf
    simulated_data = bytearray(200)
    struct.pack_into("<I", simulated_data, 0, 30)  # Version 30
    struct.pack_into("<4s", simulated_data, 4, b"SCCA")
    exec_bytes = "CCLEANER.EXE".encode("utf-16le")
    simulated_data[16:16+len(exec_bytes)] = exec_bytes
    struct.pack_into("<I", simulated_data, 76, 0xA4B7D89C)  # Hash

    # Populate 2 Execution Filetimes (Current UTC and 1 hour prior)
    ft_now = int((datetime.now(timezone.utc) - datetime(1601, 1, 1, tzinfo=timezone.utc)).total_seconds() * 10_000_000)
    struct.pack_into("<Q", simulated_data, 84, ft_now)
    struct.pack_into("<Q", simulated_data, 92, ft_now - 36_000_000_000)  # 1 hr prior

    struct.pack_into("<I", simulated_data, 148, 0x482910AA)  # Volume Serial
    struct.pack_into("<I", simulated_data, 152, 14)          # Run Count
    struct.pack_into("<I", simulated_data, 156, 48)          # Loaded Files Count

    parser = WindowsPrefetchParser()
    meta = parser.parse_win10_raw_header(bytes(simulated_data), "CCLEANER.EXE-A4B7D89C.pf")
    print(f"Parsed Prefetch Metadata:\n{json.dumps(asdict(meta), indent=2)}")

Correlating automated Prefetch outputs with registry Shimcache entries delivers indisputable evidence of program execution, defeating wipe-and-delete defense arguments in federal court.

5. Conclusion & Key Takeaways

Windows execution artifacts—specifically Windows Prefetch (.pf), Shimcache (AppCompatCache), and Amcache.hve—form the cornerstone of digital forensics investigations. By correlating run counts, historical execution timestamps, and cryptographic hashes across these complementary data sources, forensic investigators construct airtight, court-admissible timelines of program execution that withstand intense cross-examination under Federal Rule of Evidence 702.

Key strategic takeaways for forensic examiners, incident responders, and litigation counsel include:

1. Correlate Multiple Execution Artifacts: Never rely on a single artifact; validate Prefetch execution counts against Shimcache entries, Amcache SHA-1 hashes, and UserAssist logs.
2. Handle MAM Compression Correctly: Decompress Windows 10/11 Prefetch files using verified XPRESS Huffman algorithms to prevent parsing errors.
3. Extract Volatile Memory Before Power-Off: Capture live RAM to preserve in-memory Shimcache tables and volatile network sockets before system shutdown.
4. Uncover Anti-Forensics Wiping Tools: Look for execution records of CCleaner, SDelete, or BleachBit executed immediately prior to computer surrender or collection.
5. Prove Removable USB Execution: Use Shimcache file path listings to prove that unauthorized tools or exfiltration scripts were launched directly from external USB media.
6. Establish Evidentiary Defensibility under FRE 902(14): Maintain detailed forensic acquisition logs, write-blocker certifications, and SHA-256 image hashes to admit execution timelines without live custodian testimony.
7. Document Tool Validation Test Suites: Benchmark open-source parsing scripts against NIST Computer Forensic Tool Testing (CFTT) synthetic datasets to satisfy Daubert standards.
8. Analyze Volume Serial Numbers: Map internal Prefetch volume serial number tags to historical partition GUIDs to detect execution from unmounted virtual drives.
9. Reconstruct Malware Infection Vectors: Trace parent-child process lineages by cross-referencing initial browser download timestamps with subsequent executable launch records.
10. Prepare Demonstrative Trial Exhibits: Format multi-artifact execution chronologies with clear UTC timestamps and verified hash cross-references for judge and jury comprehension.

6. Frequently Asked Questions (FAQ)