ShimCache (AppCompatCache)
Also called AppCompatCache, application compatibility cache, shim cache.
- PLATFORM
- Windows
- CATEGORY
- Program Execution
- INDEX
- 14 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
A capped registry cache of file paths the compatibility layer evaluated, holding each file's path and its last-modified time — and, on modern Windows, no reliable indicator of execution.
Where it lives
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of shimcache (appcompatcache)” is neither.
What it records
The application compatibility cache stores an ordered set of entries, each holding a file path and the file's last-modified timestamp as recorded in the filesystem. Ordering reflects the recency of insertion into the cache rather than any timestamp in the entry. Windows XP and 7 carried an execution flag; on Windows 8 and later there is no reliable execution indicator. The cache is held in memory and written to the registry hive at shutdown, so on a system that has not shut down cleanly the on-disk copy lags what is in memory.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- That a file at a given path existed and was evaluated by the compatibility layer
- The file's last-modified time as it stood when the entry was created, which can identify a specific build of a tool
- A relative ordering of entries, useful for placing a path among others in insertion sequence
- That a binary was present at a path even where the file has since been deleted and AmCache has no entry
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- That the program ran. On Windows 8 and later there is no dependable execution flag, and entries can be created by the shell merely enumerating a directory containing the file
- When the entry was created. Entries carry the file's modification time, not a time of evaluation, so the cache supplies sequence and not dates
- Who was logged on. The cache is machine-wide with no user attribution
- A complete picture. The cache is capped — 1,024 entries on modern builds — so older paths are evicted
- Anything from the on-disk copy about recent activity on a running system, because entries are flushed to the registry at shutdown and until then live only in memory
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Correcting testimony that a ShimCache entry proves a tool was run — a claim the artifact does not support and the single most quotable error in this area
- Establishing that mere directory enumeration can create the entry, so presence in the cache is consistent with the user never touching the file
- Pointing out that the timestamp in the entry belongs to the file's metadata, which can itself have been altered
- Showing the eviction cap removed the period at issue, or that a live acquisition captured a stale on-disk cache
What survives, and for how long
Entries persist in the registry hive across reboots until evicted by the cap. Because the in-memory cache is written at shutdown, an image taken from a running system may not contain the most recent entries at all — a distinction that has to be stated when the acquisition was live.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
Does a ShimCache entry prove a program was executed?
No. On Windows 8 and later the application compatibility cache carries no reliable execution indicator, and an entry can be created by the shell simply enumerating a directory that contains the file. It establishes that a file at that path existed and was evaluated. An examiner who tells a factfinder that a ShimCache entry proves a wiping tool was run has stated something the artifact does not support.
What is the difference between ShimCache and AmCache?
Both record file presence rather than execution, but they hold different things. ShimCache is a capped registry cache of paths with the file's last-modified time, ordered by insertion and with no dates of its own. AmCache is a separate hive maintained by the compatibility appraiser holding richer metadata including a SHA-1 hash. Where identification of a specific binary matters, AmCache is the more useful of the two.
Why does ShimCache appear empty on a live acquisition?
Because the cache is maintained in memory and written to the registry hive at shutdown. An image taken from a running system captures the on-disk copy as it stood after the last clean shutdown, so recent entries may be absent entirely. That is a property of the artifact rather than evidence about the system, and it belongs in the report whenever the acquisition was live.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
AmCache
A registry hive maintained by the compatibility appraiser recording that binaries were present on the system, with their paths, publishers, sizes and a SHA-1 of the file.
Prefetch
Files Windows writes to speed up program launches, recording that an executable ran, when it last ran, how many times, and which files it loaded on startup.
UserAssist
A per-user registry record of programs and shortcuts launched through the Windows graphical shell, with a run count, focus time, and the last execution time.
BAM and DAM
A registry record, organised by user SID, of the last execution time of individual executables — the rare Windows artifact that attributes execution to an account directly.
Whether the shimcache (appcompatcache)evidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.