EZ Tools

AmCacheParser

This program is different from other Amcache parsers in that it does not dump everything available. Rather, it looks at both File entries and Program entries.

Link: https://github.com/EricZimmerman/AmcacheParser

Parse the Amcache hive

Use the Windows.Forensics.Amcache artifact to parse the Amcache hive.

velociraptor -v -r Windows.Forensics.Amcache -o c:\output\test.zip

Using the registry hunter

The Registry Hunter contains several targets to parse the Amcache hive.

velociraptor -v --definitions ./Windows.Registry.Hunter.zip -r Windows.Registry.Hunter --RuleFilter AmCache -o c:\output\test.zip