What Is the AmCache Hive and What It Records About You

What AmCache actually records

The hive lives at C:\Windows\appcompat\Programs\Amcache.hve and belongs to the application compatibility infrastructure that arrived with Windows 8 (Windows 7 did the same job with a file called RecentFileCache.bcf). Every executable that runs gets an entry: full path, SHA-1 hash of the binary, file size, timestamps, digital signature and publisher, and details from the PE header such as the link time — when the program was actually compiled. Separate sections inventory installed software, drivers and devices: DeviceContainer entries record USB devices with the first time each one connected.

None of this is malware. It is the compatibility database doing diagnostics, the same mechanism that lets Windows apply per-program compatibility fixes. But the same completeness makes AmCache the single richest execution-history artifact on the system: in incident response it is routinely used to prove that a specific program ran from a specific drive on a specific date. Your browser history covers your browsing; this file covers everything else.

• C:\Windows\appcompat\Programs\Amcache.hve — the hive itself, locked while Windows runs
• Root\InventoryApplicationFile — every program run: path, SHA-1, size, publisher, link time
• Root\InventoryApplication — installed software as the compatibility subsystem sees it
• Root\DeviceContainer — USB devices with first-connect timestamps
• Amcache.hve.LOG1 / .LOG2 — transaction logs that carry copies of the same records

Deleting it is harder — and less useful — than it sounds

You cannot delete the hive from a running system: it is held open by the registry, and Windows recreates it on the next boot anyway. Deleting offline — from the recovery environment, or by loading the hive with reg load from another OS — works and breaks nothing, but it barely dents the trail. The same execution history survives in the ShimCache (AppCompatCache) inside the SYSTEM hive, in Prefetch files under C:\Windows\Prefetch with their own run timestamps, in the SRUM database tracking per-app resource usage, in UserAssist counters inside each user's NTUSER.DAT, and in ordinary Jump Lists and LNK files. AmCache is one witness out of six, not the whole case file.

So the honest framing matters: AmCache is readable only with administrator rights, and the realistic threat model is forensics, incident response, or someone with admin access going through the machine after the fact. For day-to-day privacy from the websites you visit, browser hygiene does the job. For a machine you are selling or retiring, no surgical deletion of artifacts matches a clean reinstall or a wiped disk — that is the only answer that removes all six witnesses at once.

Questions and Answers

Read next