メニュー
Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | recentfilecacheparser |
| version | 1.0.0 |
| description | Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference. |
| metadata | {"tool-name":"RecentFileCacheParser","tool-vendor":"Eric Zimmerman"} |
RecentFileCacheParser is Eric Zimmerman's command-line tool for parsing Windows RecentFileCache.bcf files. These files are found on Windows 7/Server 2008 R2 systems and record paths of recently executed programs, providing evidence of application execution. Forensic interpretation of RecentFileCache data (execution timeline analysis, etc.) belongs in a separate analysis skill.
RecentFileCacheParser.exe -f <file> [--csv <dir> | --json <dir>] [other options]
Single-letter options use a single dash (-). Multi-character options use double dashes (--).
| Flag | Description |
|---|---|
-f | RecentFileCache.bcf file to process. Required. |
| Flag | Description |
|---|---|
--csv | Directory to write CSV output |
--csvf | Custom filename for CSV output (overrides default) |
--json | Directory to write JSON output |
It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.
| Flag | Description | Default |
|---|---|---|
-q | Suppress per-file output; show only filename being processed | FALSE |
--pretty | Use human-readable layout for JSON export | FALSE |
Output columns depend on tool version.
| Column | Description |
|---|---|
| SourceFile | Path to the source RecentFileCache.bcf file |
| SourceCreated | .bcf file creation timestamp |
| SourceModified | .bcf file last modified timestamp |
| SourceAccessed | .bcf file last accessed timestamp |
| Filename | Full path of the recently executed file |
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output"
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output" --csvf RecentFileCache_parsed.csv
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --json "C:\Cases\Output" --pretty
RecentFileCacheParser.exe -f "E:\Windows\AppCompat\Programs\RecentFileCache.bcf" --csv "C:\Cases\Output"
Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
Parse and extract Windows Jump List files (AutomaticDestinations and CustomDestinations) using Eric Zimmerman's JLECmd. Covers CLI flags, output formats (CSV/JSON/HTML), AppID mappings, and output field reference.
Parse and extract Windows shortcut (.lnk) files using Eric Zimmerman's LECmd. Covers CLI flags, output formats (CSV/JSON/XML/HTML), removable drive filtering, and output field reference.
Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.