IT Forensics – Windows
Forensic analysis of ShimCache (AppCompatCache) – evidence of applications that have been run
Der ShimCache, auch AppCompatCache genannt, ist ein wichtiges Windows-Artefakt. Er enthält Informationen über ausführbare Dateien, die vom Betriebssystem erfasst wurden, und kann je nach Windows-Version wertvolle Hinweise auf die Nutzung von Programmen liefern. Seine Aussagekraft hängt jedoch vom jeweiligen Betriebssystem und den konkreten Umständen des Einzelfalls ab.
In einer professionellen Windows-Forensik wird der ShimCache niemals isoliert bewertet. Erst die Korrelation mit Artefakten wie Amcache, Prefetch-Dateien, der Windows Registry, Event Logs, der Master File Table (MFT) und dem USN Journal ermöglicht eine belastbare technische Rekonstruktion.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse ShimCache entries, assess their significance within the respective Windows system and cross-check the results against other artefacts. All stages of the investigation are documented in a transparent manner and placed within the overall context of the investigation.
Typical areas of application
So läuft eine ShimCache-forensische Untersuchung ab
Once a forensic image has been created, the ShimCache is extracted from the relevant system data and analysed. This is followed by correlation with other digital evidence. Only then are the results technically assessed and fully documented.
Warum ist der ShimCache wichtig?
The ShimCache can provide clues about programmes that have been detected by Windows. Whether it is possible to draw conclusions about whether a programme has actually been executed depends on the specific system and the overall analysis of all relevant artefacts.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of the ShimCache or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.