菜单
Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | appcompatcacheparser |
| version | 1.0.0 |
| description | Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference. |
| metadata | {"tool-name":"AppCompatCacheParser","tool-vendor":"Eric Zimmerman"} |
AppCompatCacheParser is Eric Zimmerman's command-line tool for parsing the Windows Application Compatibility Cache (ShimCache) from the SYSTEM registry hive. It extracts execution metadata including file paths, last modified timestamps, and execution flags. Forensic interpretation of ShimCache data (execution timeline analysis, program existence verification, etc.) belongs in a separate analysis skill.
AppCompatCacheParser.exe --csv <dir> [-f <file>] [other options]
Single-letter options use a single dash (-). Multi-character options use double dashes (--).
| Flag | Description |
|---|---|
-f | Full path to SYSTEM hive file to process. If not specified, the live Registry is used. |
| Flag | Description |
|---|---|
--csv | Directory to write CSV output. Required. |
--csvf | Custom filename for CSV output (overrides default) |
It's recommended to write results to a file. Forensic output can be very large and may consume the context window. CSV is the most common choice for analysis with Timeline Explorer or Excel.
| Flag | Description | Default |
|---|---|---|
--c | ControlSet to parse. Default extracts all control sets. | all |
-t | Sort last modified timestamps in descending order | FALSE |
--dt | Custom date/time format string | yyyy-MM-dd HH:mm:ss |
--nl | Ignore transaction log files for dirty hives | FALSE |
--debug | Show debug information | FALSE |
--trace | Show trace information | FALSE |
Output columns depend on tool version.
| Column | Description |
|---|---|
| ControlSet | ControlSet the entry was extracted from |
| CacheEntryPosition | Position of the entry in the cache (execution order indicator) |
| Path | Full path to the executable |
| LastModifiedTimeUTC | Last modified timestamp of the file (UTC) |
| Executed | Execution flag (when available; not reliable on all OS versions) |
| Duplicate | Whether this entry is a duplicate across control sets |
| SourceFile | Path to the source SYSTEM hive file |
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output"
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --csvf ShimCache_parsed.csv
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --c 1
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" -t
AppCompatCacheParser.exe --csv "C:\Cases\Output"
AppCompatCacheParser.exe -f "C:\Cases\Evidence\SYSTEM" --csv "C:\Cases\Output" --nl
Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
Parse and extract Windows Jump List files (AutomaticDestinations and CustomDestinations) using Eric Zimmerman's JLECmd. Covers CLI flags, output formats (CSV/JSON/HTML), AppID mappings, and output field reference.
Parse and extract Windows shortcut (.lnk) files using Eric Zimmerman's LECmd. Covers CLI flags, output formats (CSV/JSON/XML/HTML), removable drive filtering, and output field reference.
Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.
Parse and extract Windows Prefetch (.pf) files using Eric Zimmerman's PECmd. Covers CLI flags, output formats (CSV/JSON/HTML), keyword highlighting, and output field reference.