appcompatcacheparser

name	appcompatcacheparser
version	1.0.0
description	Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
metadata	{"tool-name":"AppCompatCacheParser","tool-vendor":"Eric Zimmerman"}

AppCompatCacheParser Skill

AppCompatCacheParser is Eric Zimmerman's command-line tool for parsing the Windows Application Compatibility Cache (ShimCache) from the SYSTEM registry hive. It extracts execution metadata including file paths, last modified timestamps, and execution flags. Forensic interpretation of ShimCache data (execution timeline analysis, program existence verification, etc.) belongs in a separate analysis skill.

Command Syntax

AppCompatCacheParser.exe --csv <dir> [-f <file>] [other options]

Single-letter options use a single dash (-). Multi-character options use double dashes (--).

Input

Flag	Description
-f	Full path to SYSTEM hive file to process. If not specified, the live Registry is used.

Output Formats

Flag	Description
--csv	Directory to write CSV output. Required.
--csvf	Custom filename for CSV output (overrides default)

It's recommended to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.

Options

Flag	Description	Default
--c	ControlSet to parse. Default extracts all control sets.	all
-t	Sort last modified timestamps in descending order	FALSE
--dt	Custom date/time format string	yyyy-MM-dd HH:mm:ss
--nl	Ignore transaction log files for dirty hives	FALSE
--debug	Show debug information	FALSE
--trace	Show trace information	FALSE

Common Output Fields (CSV)

Output columns depend on tool version.

Column	Description
ControlSet	ControlSet the entry was extracted from
CacheEntryPosition	Position of the entry in the cache (execution order indicator)
Path	Full path to the executable
LastModifiedTimeUTC	Last modified timestamp of the file (UTC)
Executed	Execution flag (when available; not reliable on all OS versions)
Duplicate	Whether this entry is a duplicate across control sets
SourceFile	Path to the source SYSTEM hive file

Workflow Examples

Parse a SYSTEM hive to CSV

AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output"

Parse with custom output filename

AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --csvf ShimCache_parsed.csv

Parse a specific ControlSet

AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --c 1

Parse with descending timestamp sort

AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" -t

Parse the live system Registry

AppCompatCacheParser.exe --csv "C:\Cases\Output"

Parse dirty hive without transaction logs

AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --nl