Where Is the Amcache.hve File Stored?
Amcache.hve is a registry hive at C:\Windows\AppCompat\Programs\Amcache.hve. It records execution and inventory data used in forensics.
Last updated
Windows keeps Amcache.hve in C:\Windows\AppCompat\Programs. The hive tracks installed programs, drivers and recently run executables with timestamps and hashes.
The file stays locked while Windows runs. Copy it from an elevated session or a volume shadow copy for offline review, and collect the transaction logs alongside it.
Where Amcache stores this, by platform
C:\Windows\AppCompat\Programs\Amcache.hve
Requires Administrator or SYSTEM rights. Collect Amcache.hve.LOG1, Amcache.hve.LOG2 and any TMP files for clean parsing. Use Registry Explorer or AmcacheParser on a copy, not the live hive.
Frequently asked questions
Why is Amcache.hve locked?
The kernel holds the hive open during normal operation. Create a shadow copy or boot to alternate media, then copy the hive and logs for analysis.
Does deleting Amcache.hve clear history?
Windows recreates the hive after deletion, but removal destroys evidence and can affect compatibility tracking. Preserve a copy before any cleanup in lab or forensic work.
Notice an outdated path? Let us know.