XingLo SkillSearch

RecentFileCache 执行痕迹解析

面向 Windows 7 / Server 2008 R2 的 RecentFileCache.bcf 执行痕迹取证，指导使用 Eric Zimmerman 的 RecentFileCacheParser 将缓存内容导出为 CSV 或 JSON。该痕迹主要记录近期被系统观察到的可执行文件完整路径，可同时保留来源文件的创建、修改和访问时间等信息。适合老版本 Windows 主机中快速发现曾出现或可能执行过的程序，在 Prefetch、Amcache 或事件日志缺失时作为补充证据，并可用于恶意程序路径筛查和执行时间线辅助研判。

在 AI 中使用此 Skill将本页链接复制给 AI，即可让 AI 获取完整 Skill 内容并按此执行
安全提示： 本站 Skill 均经 ChatGPT 最新模型扫描，未发现恶意脚本及危险指令、未检出已知恶意行为特征，但不保证绝对安全，使用即表示接受此风险

Skill 文件

版本 20260318 · 27432bd707e22f33b119118751b7d14c

SKILL.md
---
name: recentfilecacheparser
version: 1.0.0
description: Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference.
metadata:
  tool-name: RecentFileCacheParser
  tool-vendor: Eric Zimmerman
---

# RecentFileCacheParser Skill

RecentFileCacheParser is Eric Zimmerman's command-line tool for parsing Windows RecentFileCache.bcf files. These files are found on Windows 7/Server 2008 R2 systems and record paths of recently executed programs, providing evidence of application execution. Forensic interpretation of RecentFileCache data (execution timeline analysis, etc.) belongs in a separate analysis skill.

## Command Syntax

```
RecentFileCacheParser.exe -f <file> [--csv <dir> | --json <dir>] [other options]
```

Single-letter options use a single dash (`-`). Multi-character options use double dashes (`--`).

## Input

| Flag | Description |
|------|-------------|
| `-f` | RecentFileCache.bcf file to process. Required. |

## Output Formats

| Flag | Description |
|------|-------------|
| `--csv` | Directory to write CSV output |
| `--csvf` | Custom filename for CSV output (overrides default) |
| `--json` | Directory to write JSON output |

It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `-q` | Suppress per-file output; show only filename being processed | FALSE |
| `--pretty` | Use human-readable layout for JSON export | FALSE |

## Common Output Fields (CSV)

Output columns depend on tool version.

| Column | Description |
|--------|-------------|
| **SourceFile** | Path to the source RecentFileCache.bcf file |
| **SourceCreated** | .bcf file creation timestamp |
| **SourceModified** | .bcf file last modified timestamp |
| **SourceAccessed** | .bcf file last accessed timestamp |
| **Filename** | Full path of the recently executed file |

## Workflow Examples

### Parse RecentFileCache.bcf to CSV

```
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output"
```

### Parse with custom output filename

```
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output" --csvf RecentFileCache_parsed.csv
```

### Export to JSON with pretty formatting

```
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --json "C:\Cases\Output" --pretty
```

### Parse from a mounted forensic image

```
RecentFileCacheParser.exe -f "E:\Windows\AppCompat\Programs\RecentFileCache.bcf" --csv "C:\Cases\Output"
```