# Amcache Parser

Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.

## Run it

- **CLI:** `gizza tool amcache-parser 'Paste hex bytes starting with 72 65 67 66 (ASCII "regf"), or switch the encoding below to Base64'`
- **Web:** https://gizza.ai/tools/amcache-parser/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/amcache-parser/tool.json

## Inputs

- `data` — Hive bytes _(field)_
- `input_encoding` — Input encoding _(field)_
- `section` — Record family _(field)_
- `mode` — Output format _(field)_
- `association` — Program association _(field)_
- `filter` — Filter (optional) _(field)_
- `sort` — Sort order _(field)_
- `max_entries` — Maximum records _(field)_

## Output

- Amcache records (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `data` — Hive bytes
- `input_encoding` — Input encoding
- `section` — Record family
- `mode` — Output format
- `association` — Program association
- `filter` — Filter (optional)
- `sort` — Sort order
- `max_entries` — Maximum records

Example: `https://gizza.ai/tools/amcache-parser/?data=Paste%20hex%20bytes%20starting%20with%2072%2065%2067%2066%20%28ASCII%20%22regf%22%29%2C%20or%20switch%20the%20encoding%20below%20to%20Base64&input_encoding=hex&section=auto&mode=report&association=all&filter=publisher%2C%20filename%2C%20path%2C%20ProgramId%20or%20SHA-1%20substring&sort=time&max_entries=200`

---

## About this tool

Amcache Parser is a local DFIR helper for Windows `Amcache.hve` hives. Encode the hive as hex or Base64, paste it into the form, and extract application-inventory records that often preserve executable paths, publishers, versions, SHA-1 hashes, ProgramId links and timestamps.

The parser understands both modern `Root\\InventoryApplicationFile`, `Root\\InventoryApplication`, `Root\\InventoryDriverBinary` and `Root\\InventoryApplicationShortcut` containers, plus the legacy Windows 7/8 `Root\\File` and `Root\\Programs` schema with numeric value names. Output can be a grouped report, a dense one-line list, CSV, Sleuth Kit bodyfile rows, or a de-duplicated hash list for lookup workflows.

### Worked example

To list executable records after installing the CLI:

```bash
gizza tool amcache-parser data="$(xxd -p -c 256 Amcache.hve)" input_encoding=hex section=files mode=list association=all sort=time max_entries=200
```

For a quick browser smoke test, paste `72656766` with the default hex encoding. The tool should reject it as a truncated registry hive and explain that a full `regf` base block is required.

### Limits and edge cases

- This tool parses one pasted `Amcache.hve` at a time. It does not read live registry paths, mounted disk images or folders of hives.
- It does not replay `.LOG`, `.LOG1` or `.LOG2` registry transaction logs, so dirty hives may miss the newest appraiser writes until replayed elsewhere.
- Key last-write time is the appraiser's last observation of a record, not a guaranteed first-run time. PE link dates are compiler metadata and can be forged.
- SHA-1 values are present only when Amcache recorded a `FileId`, `Hash` or `DriverId`; records without a usable hash still appear in report/list/CSV modes.
- Unknown or vendor-specific values are preserved as extra fields instead of being silently discarded.

## FAQ

<details>
<summary>Do I paste a file path or the hive bytes?</summary>

Paste the hive bytes encoded as hex or Base64. Browser and chat blocks cannot read local disk paths directly, so encode `C:\\Windows\\AppCompat\\Programs\\Amcache.hve` first with a tool such as `xxd` or `base64`.

</details>

<details>
<summary>Does Amcache prove a program executed?</summary>

Not by itself. Amcache is strong evidence that Windows appraiser observed a file or application, and it often includes useful paths and hashes, but execution claims should be corroborated with Prefetch, ShimCache, SRUM, event logs, LNK files and other artifacts.

</details>

<details>
<summary>Why are there modern and legacy schemas?</summary>

Windows changed Amcache layout over time. Modern hives use named `Inventory*` containers, while older hives store records under `Root\\File` and `Root\\Programs` with numeric value names. This tool checks both layouts and reports which one was found.

</details>

<details>
<summary>What is the association filter?</summary>

File records may carry a `ProgramId` that links them to an installed-program record. Use `associated` to focus on files tied to a known program, or `unassociated` to surface orphan executable records that may deserve closer review.

</details>

## Related tools

- [Shellbags Parser](https://gizza.ai/tools/shellbags-parser/): Parse Windows shellbags from a registry hive pasted as hex or Base64: walk BagMRU, decode shell items and rebuild the folder paths a user browsed, deleted ones included.
- [USN Journal Parser](https://gizza.ai/tools/usnjrnl-parser/): Parse an NTFS $UsnJrnl:$J change journal from hex or Base64 and list file create, rename, write and delete events with UTC timestamps, locally.
- [LZNT1 Decompress](https://gizza.ai/tools/lznt1-decompress/): Decompress LZNT1 (Windows RtlCompressBuffer) blobs from hex or Base64 in your browser — registry hives, hiberfil, malware configs. Free, private, no sign-up.
- [Memory Strings Extractor](https://gizza.ai/tools/memory-strings/): Extract ASCII and UTF-16LE strings from a memory or process dump, then group URLs, IPs, emails, domains, file paths and registry keys locally.
- [Registry Hive Parser](https://gizza.ai/tools/registry-hive-parser/): Parse offline Windows registry hive bytes from hex or Base64, inspect regf header integrity, browse keys and values, and sweep Run/RunOnce autostart locations locally.