ShimCache and AmCache Forensic Analysis 2025

Cyber Triage guide to ShimCache and AmCache execution artifacts.

Explains what each artifact records about executables, how to parse them and the common pitfall that ShimCache alone does not prove execution. Essential for building evidence of program use.

Why it's useful

Core artifacts for answering 'did this program run?'

Category: DFIR
Pricing: Free
Tags: dfir, windows, execution, artifacts
Link: www.cybertriage.com