Command-line Parsers¶

Use the parser that matches the artefact and investigation question. Work from an identified acquisition or verified working copy, write results to separate case storage, and retain the exact command, version, warnings and output hash.

AmcacheParser
Review program inventory and compatibility records; presence is not proof of execution.
AppCompatCacheParser
Review ShimCache paths and source-specific metadata; do not label its timestamp as a last-run time.
PECmd
Parse Windows Prefetch for stronger execution-related evidence where Prefetch is available.
EvtxECmd
Normalise EVTX records while retaining provider, event ID, record ID, channel and time context.

Keep the inference narrower than the output

A parser can make records reviewable, but it cannot repair missing source data or prove intent. Corroborate significant findings with another artefact, log, timeline or endpoint source.

AmcacheParser¶

AmcacheParser is a forensic tool used to parse the Windows Amcache.hve registry hive and extract application and executable metadata. The hive is normally located at:

C:\Windows\AppCompat\Programs\Amcache.hve

Windows uses Amcache as part of application compatibility and inventory processing. Its records can help establish that an executable was present or known to the system, but an Amcache entry alone is not definitive proof that the executable ran.

Testing AmcacheParser¶

On an administrator Command Prompt in the authorised training environment, use AmcacheParser to parse the hive and export the results to CSV:

amcacheparser.exe -i -f C:\Windows\AppCompat\Programs\Amcache.hve --csv C:\Labs --csvf amcache.csv

AmcacheParser produces several CSV files for analysis. The UnassociatedFileEntries output contains information about executables that may not have been associated with an installation package, making it useful when looking for anomalous executable files.

Open amcache_UnassociatedFileEntries.csv in Timeline Explorer. Locate 7z2600-x64.exe, retain the row and source fields, and copy its recorded SHA-1 hash for a reputation lookup in VirusTotal.

In the illustrated result, the hash is identified as a 7-Zip installer and is not reported as malicious. This lookup can add context when reviewing an unknown executable, but reputation is not a forensic verdict: retain the hash, lookup time and result, and corroborate the file with other evidence.

Search the hash; protect the evidence

A hash lookup does not require uploading the evidential file. Do not upload confidential or case material to a third-party service unless disclosure is explicitly authorised.

AppCompatCacheParser¶

AppCompatCacheParser is a command-line tool that processes Windows AppCompatCache, also called ShimCache, from a SYSTEM registry hive and exports its entries for further analysis.

ShimCache is part of Windows application compatibility. It can retain executable paths and associated source-specific metadata. A matching entry may support that an executable existed or was observed by the compatibility mechanism, but it does not by itself prove execution. Timestamp meaning also depends on the Windows version and should not automatically be labelled “last execution”.

Testing AppCompatCacheParser¶

For this training test, first create a backup copy of the local SYSTEM hive. Open an administrator Command Prompt and run:

reg save HKLM\SYSTEM C:\Labs\registry\SYSTEM.bak

This live reg save command changes the training system. In a case workflow, prefer an acquired offline hive or explicitly document the authorised live collection and its effect.

Use AppCompatCacheParser to process the offline SYSTEM-hive copy and export the results to CSV:

appcompatcacheparser -f C:\Labs\registry\SYSTEM.bak --csv C:\Labs --csvf appcompatcache.csv

AppCompatCacheParser 2026.5.0 may display a missing Microsoft.Win32.Registry, Version=4.1.1.0 assembly error in the illustrated environment. Preserve the error and use the complete supported release package. The original SUSA test used version 1.5.1.0 as a temporary recorded fallback.

Open appcompatcache.csv in Timeline Explorer. The illustrated output contains an entry for KAPE (gkape) with the timestamp 2026-04-08 02:38:35.

Report this as a ShimCache entry with its recorded timestamp and source context. Corroborate with Prefetch, event logs or another independent source before concluding that KAPE executed at that time.

PECmd¶

PECmd parses Windows Prefetch (.pf) files. Where the operating system creates and retains Prefetch, the records can support application-execution findings, including recorded run times, run count and referenced resources.

Testing PECmd¶

From C:\Windows\Prefetch, copy a Prefetch file for CHROME.EXE and paste it into C:\Lab. In a case, perform this step against an authorised source or verified working copy and record the source and destination hashes.

Open a Command Prompt and run the following command to parse the copied Chrome Prefetch file:

PECmd.exe -f C:\Labs\CHROME.EXE-AED7BA3C.pf

Record the Prefetch filename, executable name, run count, available run times, source path and parser warnings. Absence is not proof of non-execution because Prefetch may be disabled, cleared, overwritten or unavailable.

EvtxECmd¶

EvtxECmd converts Windows Event Log files into reviewable CSV, JSON or XML. This makes it easier to filter, sort and search event records while retaining the original EVTX alongside the derived output.

Open an administrator Command Prompt and run the following command to parse the Security log:

evtxecmd -f C:\Windows\System32\winevt\Logs\Security.evtx --csv C:\Labs\event-logs --csvf security.csv

This example reads a live-system log in an authorised training environment. In a forensic case, prefer a copied or acquired EVTX source, record any live access, and write the CSV to separate controlled storage.

Open security.csv in Timeline Explorer. Timeline Explorer lets the analyst filter, sort and search records to review logon activity, account changes, process creation and other events of interest.

Keep provider, event ID, record ID, channel, computer and timestamp attached to each observation, and interpret significant events in their surrounding sequence and provider documentation.

Which parser should you use?¶

Do not run every parser simply because its source is available. Start with the case question, choose the artefact most capable of answering it, then use a different source to test or qualify the result. These are starting points, not claims that the source is complete.

PROGRAM INVENTORY

Was this program known to the host?

Start with: AmcacheParser and the verified Amcache.hve.

It can support file presence or application-inventory context. An entry alone does not prove execution.Review AmcacheParser

RECORDED PATH

Was this path represented in ShimCache?

Start with: AppCompatCacheParser and an offline SYSTEM hive.

Interpret entry and timestamp meaning for the source Windows version; ShimCache alone does not prove execution.Review AppCompatCacheParser

EXECUTION-RELATED EVIDENCE

Is there retained evidence that an application ran?

Start with: PECmd and the relevant Prefetch file.

Prefetch can provide run-time and run-count context, but may be disabled, cleared or overwritten.Review PECmd

SURROUNDING ACTIVITY

Which logged events surround the activity?

Start with: EvtxECmd and the relevant acquired EVTX log.

Coverage depends on audit policy, channel state and retention. Missing events do not prove an action did not occur.Review EvtxECmd

A beginner-friendly sequence

If the question is whether an application likely ran, begin with Prefetch and PECmd. Then use Amcache or ShimCache for presence and path context, and EVTX for surrounding activity. Keep the conclusion limited to what the combined records actually show.