Where Is the Windows RecentFileCache.bcf?
Windows RecentFileCache.bcf in AppCompat Programs with executed program traces.
Last updated
Windows logs executed programs into RecentFileCache.bcf under the AppCompat Programs folder, a simple binary list of paths investigators check first. Entries appear on execution and survive reboots.
The file complements prefetch with a lighter footprint. Read it from a disk image since live copies can tear mid-write.
Where Windows stores this, by platform
C:\Windows\AppCompat\Programs\RecentFileCache.bcf
Binary list of executed program paths maintained by the compatibility engine. Parse from an offline image with forensics tools; the format is simple but not text. Clearing it removes a timeline source investigators expect to find.
Frequently asked questions
What does RecentFileCache prove?
That listed binaries executed on the machine. It carries no timestamps, so pair it with prefetch and Shimcache for timing.
How do I read RecentFileCache.bcf?
With a forensics parser against a disk image copy. Opening the live file risks torn reads and access errors.
Notice an outdated path? Let us know.