I was poking around my system recently and noticed something that’s slightly different with the Amcache folder

It looks like C:\windows\appcompat\programs now has a few more files than before!

I’ve only done a few quick checks, but it looks like there are SQLite databases for each of the previous registry sections found within Amcache.Hve. I don’t know which version this came in, because I havent done a major update recently, and I don’t see anything obvious in the update history or changelog.

If you have a look at a standard Amcache hive you’ll notice the similarity.

Looking at the schemas, not much appears to be different. There is a timestamp, LastModified, which is a FILETIME timestamp; This seems like it’s going to replace the registry last write time for our use case. I’m not sure if there are any changes to what actually updates these entries, but in theory at least when a change is made to the entry in the database, the LastModified value should update.

There’s also a Sha256 column but that isn’t populated on my system.

The other thing seems to be that both registry hive and databases appear to be updated concurrently. My assumption here is that the hive will go away in the future but it’s there as a fallback for now. Interestingly there’s a difference in total records on my system: 4542 records in the registry hive and only 3276 in the database. This may be because my hive has been around for longer. I also haven’t checked if the database has backfilled with old data.

Here’s a screenshot of the InventoryApplicationFile database

If you want to convert the timestamp you can do so in SQL:

SELECT datetime((LastModified - 116444736000000000) / 10000000, 'unixepoch') as Timestamp, * from InventoryApplicationFile_0

So TLDR – I dont think this change is going to significantly impact or hinder DFIR investigations, but make sure you start collecting and parsing this data just in case!