AmcacheParser

A forensic analysis tool for parsing the Windows Amcache to identify executed programs and application installation activity.

AmcacheParser is a command-line forensic utility developed by Eric Zimmerman for extracting execution and application metadata from the Windows Amcache.hve registry hive. The Amcache is designed by W…