{
  "slug": "amcache-parser",
  "name": "gizza-ai/amcache-parser",
  "version": "0.1.0",
  "title": "Amcache Parser — Extract Program and Executable Evidence from Amcache.hve — gizza.ai",
  "description": "Parse Windows Amcache.hve bytes from hex or Base64 and report application, executable, driver, shortcut, SHA-1 hash and timestamp evidence locally.",
  "tags": [
    "Amcache parser",
    "Amcache.hve",
    "Windows forensics",
    "DFIR",
    "program execution",
    "application inventory",
    "SHA-1",
    "ProgramId",
    "InventoryApplicationFile",
    "Root File",
    "bodyfile",
    "mactime",
    "registry hive"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/amcache-parser/",
    "markdown": "https://gizza.ai/tools/amcache-parser/index.md",
    "descriptor": "https://gizza.ai/tools/amcache-parser/tool.json",
    "deep_link_example": "https://gizza.ai/tools/amcache-parser/?data=Paste%20hex%20bytes%20starting%20with%2072%2065%2067%2066%20%28ASCII%20%22regf%22%29%2C%20or%20switch%20the%20encoding%20below%20to%20Base64&input_encoding=hex&section=auto&mode=report&association=all&filter=publisher%2C%20filename%2C%20path%2C%20ProgramId%20or%20SHA-1%20substring&sort=time&max_entries=200"
  },
  "cli": "gizza tool amcache-parser 'Paste hex bytes starting with 72 65 67 66 (ASCII \"regf\"), or switch the encoding below to Base64'",
  "tool": {
    "description": "Parse a Windows Amcache.hve registry hive supplied as hex or Base64 and report installed applications, executable file records, driver binaries and shortcuts from both modern Root\\Inventory* containers and legacy Root\\File/Root\\Programs schemas. Extracts paths, names, publishers, versions, SHA-1 hashes, ProgramId associations, file size, key last-write times, PE link dates and install dates. Output a grouped report, one-line list, CSV, Sleuth Kit bodyfile or de-duplicated hash list. Runs locally; no upload.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "association": {
          "default": "all",
          "description": "Filter file-like records by whether their ProgramId resolves to an installed-program record. Program records themselves remain visible; use 'unassociated' to focus on orphan executable records.",
          "enum": [
            "all",
            "associated",
            "unassociated"
          ],
          "type": "string"
        },
        "data": {
          "description": "The raw Windows Amcache.hve registry hive bytes encoded as hex (default) or Base64. Paste the whole regf hive; the tool parses it locally and never uploads it.",
          "type": "string"
        },
        "filter": {
          "default": "",
          "description": "Optional case-insensitive substring matched against path, name, publisher, SHA-1, program id and extra values before the entry cap is applied.",
          "type": "string"
        },
        "input_encoding": {
          "default": "hex",
          "description": "How the hive bytes in data are encoded. 'hex' accepts contiguous or separated bytes with an optional leading 0x; 'base64' accepts standard Base64 with optional whitespace.",
          "enum": [
            "hex",
            "base64"
          ],
          "type": "string"
        },
        "max_entries": {
          "default": 200,
          "description": "Maximum records emitted after filtering. Values above 5000 are clamped, and truncation is reported in the output. Default 200.",
          "maximum": 5000,
          "minimum": 1,
          "type": "integer"
        },
        "mode": {
          "default": "report",
          "description": "Output format. 'report' is grouped and human-readable; 'list' prints one dense line per record; 'csv' emits a spreadsheet table; 'bodyfile' emits Sleuth Kit/mactime rows; 'hashes' prints a de-duplicated SHA-1 list.",
          "enum": [
            "report",
            "list",
            "csv",
            "bodyfile",
            "hashes"
          ],
          "type": "string"
        },
        "section": {
          "default": "auto",
          "description": "Which Amcache containers to report. 'auto' shows programs and executable file records; 'files', 'programs', 'drivers' and 'shortcuts' select one artifact family; 'all' includes every known modern and legacy container.",
          "enum": [
            "auto",
            "files",
            "programs",
            "drivers",
            "shortcuts",
            "all"
          ],
          "type": "string"
        },
        "sort": {
          "default": "time",
          "description": "Ordering before the entry cap. 'time' sorts by key last-write newest first; 'path' sorts by display path or name; 'none' keeps hive traversal order.",
          "enum": [
            "time",
            "path",
            "none"
          ],
          "type": "string"
        }
      },
      "required": [
        "data"
      ],
      "type": "object"
    }
  }
}