Where Is the Windows ShimCache Stored?
Windows tracks executed programs in the ShimCache registry value, a favorite of forensic investigators.
Last updated
ShimCache, formally AppCompatCache, is a registry value where Windows records executables that ran on the machine. Forensics loves it because the entries survive file deletion.
The value lives under Session Manager in the SYSTEM hive and needs admin tools to read. It stores paths and timestamps, not the files themselves. Investigators parse it with dedicated tools rather than regedit, since the binary format is unreadable by eye.
Where Windows stores this, by platform
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
AppCompatCache value in the SYSTEM hive. Read with forensic parsers, not regedit. Entries persist after file deletion, which is exactly the investigative value.
Frequently asked questions
A suspicious file is gone. Does ShimCache prove it ran?
The cache records execution, not deletion, so entries linger after uninstalls. Treat it as a lead showing something ran, then confirm with filesystem or log evidence.
Notice an outdated path? Let us know.