Where Is Amcache.hve Located?
Amcache.hve inventory of executed programs, and the parsers that read it.
Last updated
Amcache.hve sits in the AppCompat Programs folder and inventories programs that executed on the machine: paths, hashes, first run times and metadata. Application compatibility infrastructure writes it as a side effect of running anything, which makes it a quiet execution log.
Forensics treats it as a first class artifact alongside Shimcache and Prefetch. The hive format opens in any offline registry parser once copied from a non running system or a shadow copy. Entries persist after the executables vanish, so deleted tools still show their tracks here.
Where Windows stores this, by platform
C:\Windows\AppCompat\Programs\Amcache.hve
Registry hive format, locked while Windows runs. Copy it via shadow copies or offline access for analysis. Pairs with Shimcache and Prefetch for execution timeline work in incident response.
Frequently asked questions
how do i read amcache.hve
Open it with a registry hive parser or forensic Amcache tooling, since regedit cannot mount it usefully while Windows runs. Look up entries by file path or hash to find first execution times and program metadata.
can i clear the amcache inventory
No supported way exists. The inventory rebuilds as programs run, and the hive stays locked during normal operation. Privacy cleanups target user level artifacts instead, since Amcache is system owned telemetry of execution.
Notice an outdated path? Let us know.