Windows Registry: Application Compatibility Cache

By Chad Tilbury on April 19, 2012 in Computer Forensics, Windows Registry — Leave a comment
Leveraging the Application Compatibility Cache in ForensicInvestigations (Whitepaper) | http://t.co/O2PFBjm9 #DFIR
April 17, 2012 4:18 pm via webReplyRetweetFavorite
@chadtilbury
Chad Tilbury

 

UPDATE: A new Registry Ripper plugin, appcompatcache.pl, was written by Harlan Carvey based on this research.

UPDATE 2: The Volatility memory analysis framework now has a plugin, shimcache.py, for finding and parsing the Application Compatibility Cache from a memory image.

Related posts:

  1. De-mystifying Defrag : Identifying When the Windows Defragmenter Has Been Used for Anti-Forensics (Part 2 – Vista / Windows 7)
  2. Computer Forensic Artifacts: Windows 7 Shellbags
  3. Registry Backup Artifact

No Comments

Be the first to start the conversation.

Leave a Reply