The amcache registry hive which made its debut in windows 8, is now also showing up on Windows 7 systems. I was alerted to this by a fellow DFIR analyst Clint Hastings, who noticed this and has been using my scripts to parse them on windows 7 for some time now.
So, what happened? After a bit of investigation on my machines, it was traced to Windows Update KB2952664, which updates the application inventory and telemetry (Microsoft terminology for the programs that monitor application usage) executables and libraries.
The update first came out in April 2015, but it appears as if it was not widely deployed (automatically) until around October.
Both Amcache.hve and RecentFileCache.bcf are updated now. I verified this information by parsing both these artifacts. Amcache of-course, had a lot more detail about the same files. So, don't forget to look for amcache on your windows 7 examinations.
 |
| Amcache on Windows 7 |
So, what happened? After a bit of investigation on my machines, it was traced to Windows Update KB2952664, which updates the application inventory and telemetry (Microsoft terminology for the programs that monitor application usage) executables and libraries.
The update first came out in April 2015, but it appears as if it was not widely deployed (automatically) until around October.
Both Amcache.hve and RecentFileCache.bcf are updated now. I verified this information by parsing both these artifacts. Amcache of-course, had a lot more detail about the same files. So, don't forget to look for amcache on your windows 7 examinations.
Good to know - thanks for the update!
ReplyDeleteHey Yogesh! Cool beans! Question though. Is the sha1 hash you mentioned an actual SHA1 of the binary, or is it a Windows Authenticode hash (which uses SHA1, but is different)
ReplyDeleteOn an unrelated note, I was just trying to parse some IE RecoveryStore files yesterday, and discovered that your IETravelogParser.EnPack EnScript doesn't work under EnCase 7.10.05. I get the error, '"CANCHECK" is an unknown identifier'. Is there any chance you'd be willing to update this for the current version of EnCase 7?
John, its SHA1 of the binary itself. I just updated the travelog script to work with version 7, however its version 7.02 for now. Email me and let me know if this works.
DeleteGood work! Yogesh~ thx!
ReplyDelete