메뉴
Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | recentfilecacheparser |
| version | 1.0.0 |
| description | Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference. |
| metadata | {"tool-name":"RecentFileCacheParser","tool-vendor":"Eric Zimmerman"} |
RecentFileCacheParser is Eric Zimmerman's command-line tool for parsing Windows RecentFileCache.bcf files. These files are found on Windows 7/Server 2008 R2 systems and record paths of recently executed programs, providing evidence of application execution. Forensic interpretation of RecentFileCache data (execution timeline analysis, etc.) belongs in a separate analysis skill.
RecentFileCacheParser.exe -f <file> [--csv <dir> | --json <dir>] [other options]
Single-letter options use a single dash (-). Multi-character options use double dashes (--).
| Flag | Description |
|---|---|
-f | RecentFileCache.bcf file to process. Required. |
| Flag | Description |
|---|---|
--csv | Directory to write CSV output |
--csvf | Custom filename for CSV output (overrides default) |
--json | Directory to write JSON output |
It's recommended to specify at least one output format to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.
| Flag | Description | Default |
|---|---|---|
-q | Suppress per-file output; show only filename being processed | FALSE |
--pretty | Use human-readable layout for JSON export | FALSE |
Output columns depend on tool version.
| Column | Description |
|---|---|
| SourceFile | Path to the source RecentFileCache.bcf file |
| SourceCreated | .bcf file creation timestamp |
| SourceModified | .bcf file last modified timestamp |
| SourceAccessed | .bcf file last accessed timestamp |
| Filename | Full path of the recently executed file |
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output"
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --csv "C:\Cases\Output" --csvf RecentFileCache_parsed.csv
RecentFileCacheParser.exe -f "C:\Cases\Evidence\RecentFileCache.bcf" --json "C:\Cases\Output" --pretty
RecentFileCacheParser.exe -f "E:\Windows\AppCompat\Programs\RecentFileCache.bcf" --csv "C:\Cases\Output"
Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
Parse and extract Windows Jump List files (AutomaticDestinations and CustomDestinations) using Eric Zimmerman's JLECmd. Covers CLI flags, output formats (CSV/JSON/HTML), AppID mappings, and output field reference.
Parse and extract Windows shortcut (.lnk) files using Eric Zimmerman's LECmd. Covers CLI flags, output formats (CSV/JSON/XML/HTML), removable drive filtering, and output field reference.
Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.