IT Forensics – Windows
Forensic analysis of Amcache – evidence of programmes and system activity
The Amcache database is one of the key artefacts in a Windows forensic investigation. It contains information about programmes and executable files that have been detected on a Windows system. Depending on the operating system and the circumstances of the case, this can provide valuable clues about installed or running applications.
A professional analysis is never carried out in isolation. Only by correlating the findings with other Windows artefacts – such as prefetch files, the Windows Registry, event logs, the Master File Table (MFT) or the USN Journal – is it possible to make a reliable technical assessment.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.
The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
We analyse the Amcache database, evaluate entries relating to programmes and executable files, and cross-reference the findings with other digital evidence. All findings are documented in a transparent manner and placed within the overall context of the investigation.
Typical areas of application
This is how an Amcache forensic investigation is carried out
Once a forensic image has been created, the Amcache database is read and analysed. The results are correlated with other artefacts and assessed in terms of their forensic significance. All stages of the investigation are fully documented.
Why is Amcache so important?
Amcache can provide important clues about programmes that were present on or detected on a Windows system. However, the technical significance always depends on the individual case and can only be determined by analysing all relevant artefacts together.
Frequently Asked Questions
LanCologne – Windows Forensics in Cologne
Do you need a professional analysis of the Amcache database or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.
Related to this topic
- Forensic analysis of ShimCache (AppCompatCache) – evidence of applications that have been run
- Forensic analysis of SRUM – Tracking system and network activity
- Forensic analysis of Windows Timeline – tracing user activities chronologically
- Forensic analysis of the Windows Reliability Monitor – tracking system changes and errors chronologically