- Nationwide Digital Forensic & Cyber Services
- BOOK A FREE CONSULTATION TODAY!
Prove which executables ran on a Windows computer, when, how many times, under which user, and with what network and resource footprint — using Prefetch, Amcache, Shimcache, BAM/DAM, SRUM, UserAssist, and MUICache.
Quick Answer. Windows keeps at least eight independent records of program execution. Prefetch (C:\Windows\Prefetch\*.pf) records first-run, last eight runs, run count, and loaded files. Amcache.hve stores SHA-1 hashes of executed and even merely present binaries. Shimcache (AppCompatCache) inside SYSTEM hive lists recently executed files with size and modification timestamp. BAM and DAM (Background/Desktop Activity Moderator) attribute execution to a user SID. SRUM (System Resource Usage Monitor) records network bytes and foreground time per app per hour. UserAssist attributes GUI launches to a user. MUICache holds the friendly name of every application ever launched. Together they defeat almost every ‘that program never ran’ claim.
| Artifact | Path | What it records |
|---|---|---|
| Prefetch | C:\Windows\Prefetch\ | First run, last 8 run times, run count, referenced files, volume info |
| Amcache.hve | C:\Windows\AppCompat\Programs\Amcache.hve | InventoryApplicationFile: SHA-1, size, publisher, first-observed, executed timestamp |
| Shimcache | SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache | Path, $StdInfo Modified time, execution flag; up to 1024 entries |
| BAM / DAM | SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\ | Last-run timestamp per executable per user |
| SRUM | C:\Windows\System32\SRU\SRUDB.dat | Per-hour app-level network, CPU, disk usage, per SID |
| UserAssist | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist | GUI-launched executables per user, count and last-run |
| MUICache | UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache | FriendlyAppName for every executable launched |
| RecentApps (Win10) | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps | Start-menu launches with launch count |
| ActivitiesCache.db (Win10) | %LOCALAPPDATA%\ConnectedDevicesPlatform\…\ActivitiesCache.db | Timeline app + file activity |
Prefetch files are created by the Windows memory manager to accelerate cold starts. Each .pf is named <EXECUTABLE>-<8HEXHASH>.pf. The hash is a function of the full executable path, so a program run from two paths yields two distinct Prefetch files — decisive when malware is copied to C:\Users\Public\ versus C:\Windows\Temp\. Since Windows 8, each Prefetch stores up to the last eight execution timestamps, not just the last one, and the total execution count.
Prefetch also stores the list of files (DLLs, config, data files) opened in the first ten seconds of execution — commonly used to prove which document a viewer opened or which INI a tool consumed.
The Amcache.hve registry hive under Root\InventoryApplicationFile stores a per-executable record including full path, SHA-1 of the first 31,457,280 bytes (or the whole file if smaller), publisher, product name, and a first observed timestamp. Amcache is populated even for files that were merely present on disk when a compatibility scan ran, so its coverage exceeds Prefetch. The SHA-1 hash makes Amcache uniquely valuable for tying an executable on the endpoint to a known-bad sample or a sample seized elsewhere.
SRUM (SRUDB.dat, an ESE database) keeps roughly 30-60 days of per-hour statistics for every application: bytes sent, bytes received, CPU foreground/background time, disk read/write, and — critically — the user SID under which the app ran. SRUM defeats “the browser never uploaded anything” arguments by showing exact upload byte counts to the hour, and it can point at data exfiltration long after logs have rolled.
The Background Activity Moderator (bam) and Desktop Activity Moderator (dam) services store, under each user’s SID subkey, the full path of executables run and the FILETIME of the last execution. This is one of the cleanest per-user execution attributions available on Windows 10 and 11.
Each execution artifact answers a slightly different question. Reports state the collection date (Amcache first-observed vs Prefetch first-run vs Shimcache modification time can legitimately differ). Contradictions are reported plainly and rarely defeat the case; agreement across three or more artifacts is the standard for a confident finding.
Elite Digital Forensics is an independent, defense-aligned Windows forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Windows Forensics hub for the full analytical framework we bring to every matter.
If Prefetching is disabled (default off on some server SKUs and on many SSD-configured systems as of certain Windows builds), the .pf file may not be written. Amcache, Shimcache, BAM/DAM, and SRUM cover the gap — total suppression across all is very rare.
Manual manipulation is detectable: mismatched name hash vs internal path, invalid checksum, timestamps outside NTFS-plausible ranges, or a Prefetch file whose referenced volume serial does not match the machine’s disk.
UserAssist and RecentApps are per-user GUI launches — strong human evidence. Prefetch alone does not distinguish scheduled task from double-click; we combine artifacts to establish intent.
Yes. Windows 11 keeps Prefetch, Amcache, Shimcache, BAM/DAM, SRUM, UserAssist, and RecentApps, and adds packaged-app state under UsrClass.dat plus (on eligible SKUs) the Recall snapshot database.
Tell us about the computer, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder