Amcache 应用痕迹解析

---
name: amcacheparser
version: 1.0.0
description: Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
metadata:
  tool-name: AmcacheParser
  tool-vendor: Eric Zimmerman
---

# AmcacheParser Skill

AmcacheParser version 1.0.

AmcacheParser is Eric Zimmerman's command-line tool for parsing the Windows Amcache.hve registry hive. It extracts application execution metadata, installed program records, device information, and driver data into structured CSV output. Forensic interpretation of Amcache data (execution timeline analysis, software inventory correlation, etc.) belongs in a separate analysis skill.

## Command Syntax

```
AmcacheParser.exe -f <file> --csv <dir> [other options]
```

Single-letter options use a single dash (`-`). Multi-character options use double dashes (`--`).

## Input

| Flag | Description |
|------|-------------|
| `-f` | Amcache.hve file to process. Required. |

## Output Formats

| Flag | Description |
|------|-------------|
| `--csv` | Directory to write CSV output. Required. |
| `--csvf` | Custom filename for CSV output (overrides default) |

It's recommended to write results to a file. Forensic output can be very large and may consume the context window. AmcacheParser produces multiple CSV files per run (one per data type).

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `-i` | Include file entries for Programs entries | FALSE |
| `-b` | Path to file containing SHA-1 hashes to include (whitelist) | |
| `-w` | Path to file containing SHA-1 hashes to exclude (blacklist) | |
| `--dt` | Custom date/time format string | `yyyy-MM-dd HH:mm:ss` |
| `--mp` | Display higher precision timestamps | FALSE |
| `--nl` | Ignore transaction log files for dirty hives | FALSE |
| `--debug` | Show debug information | FALSE |
| `--trace` | Show trace information | FALSE |

When both `-b` and `-w` are provided, blacklist filtering takes precedence.

## Output Files

AmcacheParser produces multiple CSV files per run, one for each data type found in the hive. The hive format (new vs. old) determines which files are generated.

### New Format Hives

| File | Description |
|------|-------------|
| `*_UnassociatedFileEntries.csv` | File entries not linked to a program |
| `*_AssociatedFileEntries.csv` | File entries linked to a program |
| `*_ProgramEntries.csv` | Installed program records |
| `*_ShortCuts.csv` | Shortcut entries |
| `*_DeviceContainers.csv` | Device container records |
| `*_DevicePnps.csv` | Plug and Play device records |
| `*_DriveBinaries.csv` | Driver binary records |
| `*_DriverPackages.csv` | Driver package records |

### Old Format Hives

| File | Description |
|------|-------------|
| `*_UnassociatedFileEntries.csv` | File entries not linked to a program |
| `*_AssociatedFileEntries.csv` | File entries linked to a program |
| `*_ProgramEntries.csv` | Installed program records |

## Common Output Fields — UnassociatedFileEntries / AssociatedFileEntries (CSV, New Format)

Output columns depend on tool version and hive format.

| Column | Description |
|--------|-------------|
| **ApplicationName** | Associated application name |
| **ProgramId** | Program identifier |
| **FileKeyLastWriteTimestamp** | Registry key last write timestamp |
| **SHA1** | SHA-1 hash of the file |
| **IsOsComponent** | Whether the file is an OS component |
| **FullPath** | Full path to the file |
| **Name** | Filename |
| **FileExtension** | File extension |
| **LinkDate** | PE linker timestamp |
| **ProductName** | Product name from version info |
| **Size** | File size |
| **Version** | File version |
| **ProductVersion** | Product version |
| **LongPathHash** | Hash of the long path |
| **BinaryType** | Binary type (32-bit, 64-bit, etc.) |
| **IsPeFile** | Whether the file is a PE executable |
| **BinFileVersion** | Binary file version |
| **BinProductVersion** | Binary product version |
| **Language** | Language code |

## Common Output Fields — ProgramEntries (CSV, New Format)

| Column | Description |
|--------|-------------|
| **ProgramId** | Program identifier |
| **KeyLastWriteTimestamp** | Registry key last write timestamp |
| **Name** | Program name |
| **Version** | Program version |
| **Publisher** | Publisher name |
| **InstallDate** | Installation date |
| **OSVersionAtInstallTime** | OS version when installed |
| **BundleManifestPath** | Bundle manifest path |
| **HiddenArp** | Hidden from Add/Remove Programs |
| **InboxModernApp** | Whether it is an inbox modern app |
| **Language** | Language code |
| **ManifestPath** | Manifest path |
| **MsiPackageCode** | MSI package code |
| **MsiProductCode** | MSI product code |
| **PackageFullName** | Full package name |
| **ProgramInstanceId** | Program instance identifier |
| **RegistryKeyPath** | Source registry key path |
| **RootDirPath** | Root directory path |
| **Type** | Entry type |
| **Source** | Entry source |
| **StoreAppType** | Store app type |
| **UninstallString** | Uninstall command |

## Common Output Fields — ShortCuts (CSV)

| Column | Description |
|--------|-------------|
| **KeyName** | Registry key name |
| **LnkName** | Shortcut name |
| **KeyLastWriteTimestamp** | Registry key last write timestamp |

## Common Output Fields — DriveBinaries (CSV)

| Column | Description |
|--------|-------------|
| **KeyName** | Registry key name |
| **KeyLastWriteTimestamp** | Registry key last write timestamp |
| **DriverTimeStamp** | Driver timestamp |
| **DriverLastWriteTime** | Driver last write time |
| **DriverName** | Driver name |
| **DriverInBox** | Whether the driver is inbox |
| **DriverIsKernelMode** | Whether the driver is kernel mode |
| **DriverSigned** | Whether the driver is signed |
| **DriverCheckSum** | Driver checksum |
| **DriverCompany** | Driver company |
| **DriverId** | Driver identifier |
| **DriverPackageStrongName** | Driver package strong name |
| **DriverType** | Driver type |
| **DriverVersion** | Driver version |
| **ImageSize** | Image size |
| **Inf** | INF file name |
| **Product** | Product name |
| **ProductVersion** | Product version |
| **Service** | Service name |
| **WdfVersion** | WDF version |

## Workflow Examples

### Parse Amcache to CSV

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output"
```

### Parse with custom output filename

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output" --csvf Amcache_parsed.csv
```

### Parse with included file entries for programs

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output" -i
```

### Filter by SHA-1 whitelist

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output" -b "C:\Cases\known_hashes.txt"
```

### Filter by SHA-1 blacklist

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output" -w "C:\Cases\exclude_hashes.txt"
```

### Parse dirty hive without transaction logs

```
AmcacheParser.exe -f "C:\Cases\Evidence\Amcache.hve" --csv "C:\Cases\Output" --nl
```