Amcache Parser
Paste an Amcache.hve registry hive as hex or Base64 and extract installed-program, executable, driver and shortcut records with paths, SHA-1 hashes, ProgramId links and timestamps. Runs locally in your browser.
About this tool
Amcache Parser is a local DFIR helper for Windows Amcache.hve hives. Encode the hive as hex or Base64, paste it into the form, and extract application-inventory records that often preserve executable paths, publishers, versions, SHA-1 hashes, ProgramId links and timestamps.
The parser understands both modern Root\\InventoryApplicationFile, Root\\InventoryApplication, Root\\InventoryDriverBinary and Root\\InventoryApplicationShortcut containers, plus the legacy Windows 7/8 Root\\File and Root\\Programs schema with numeric value names. Output can be a grouped report, a dense one-line list, CSV, Sleuth Kit bodyfile rows, or a de-duplicated hash list for lookup workflows.
Worked example
To list executable records after installing the CLI:
gizza tool amcache-parser data="$(xxd -p -c 256 Amcache.hve)" input_encoding=hex section=files mode=list association=all sort=time max_entries=200
For a quick browser smoke test, paste 72656766 with the default hex encoding. The tool should reject it as a truncated registry hive and explain that a full regf base block is required.
Limits and edge cases
- This tool parses one pasted
Amcache.hveat a time. It does not read live registry paths, mounted disk images or folders of hives. - It does not replay
.LOG,.LOG1or.LOG2registry transaction logs, so dirty hives may miss the newest appraiser writes until replayed elsewhere. - Key last-write time is the appraiser's last observation of a record, not a guaranteed first-run time. PE link dates are compiler metadata and can be forged.
- SHA-1 values are present only when Amcache recorded a
FileId,HashorDriverId; records without a usable hash still appear in report/list/CSV modes. - Unknown or vendor-specific values are preserved as extra fields instead of being silently discarded.
FAQ
Do I paste a file path or the hive bytes?
Paste the hive bytes encoded as hex or Base64. Browser and chat blocks cannot read local disk paths directly, so encode C:\\Windows\\AppCompat\\Programs\\Amcache.hve first with a tool such as xxd or base64.
Does Amcache prove a program executed?
Not by itself. Amcache is strong evidence that Windows appraiser observed a file or application, and it often includes useful paths and hashes, but execution claims should be corroborated with Prefetch, ShimCache, SRUM, event logs, LNK files and other artifacts.
Why are there modern and legacy schemas?
Windows changed Amcache layout over time. Modern hives use named Inventory* containers, while older hives store records under Root\\File and Root\\Programs with numeric value names. This tool checks both layouts and reports which one was found.
What is the association filter?
File records may carry a ProgramId that links them to an installed-program record. Use associated to focus on files tied to a known program, or unassociated to surface orphan executable records that may deserve closer review.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool amcache-parser 'Paste hex bytes starting with 72 65 67 66 (ASCII "regf"), or switch the encoding below to Base64'New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/amcache-parser/?data=Paste%20hex%20bytes%20starting%20with%2072%2065%2067%2066%20%28ASCII%20%22regf%22%29%2C%20or%20switch%20the%20encoding%20below%20to%20Base64&input_encoding=hex§ion=auto&mode=report&association=all&filter=publisher%2C%20filename%2C%20path%2C%20ProgramId%20or%20SHA-1%20substring&sort=time&max_entries=200Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.