# Analyzing Evidence of Program Execution

## BAM (Background Activity Moderator) **Registry**: HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings **BAM** tracks which applications and processes were executed, even if they are no longer active or present on the system. Q) Which executables did the BAM record for the User (RID 1000) include, their last execution date and time? Let's open the SYSTEM hive into Registry Explorer.

Alternatively, we can utilize the results obtained from RegRipper.

## Application Compatibility Cache (ShimCache) **Register**: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache` The **Application Compatibility Cache (ShimCache)** is a feature in Windows operating systems designed to maintain compatibility for applications running on newer versions of Windows. It tracks the execution of applications, storing metadata such as the file path, last modified date, and file size. ShimCache provides a snapshot of executables present on the system at the time of its last shutdown or reboot. This can be invaluable in digital forensic investigations to reconstruct timelines and detect unauthorized activities. Since ShimCache entries are written to the hard drive during shutdown, it makes it harder for malicious actors to wipe out evidence of their activities. Let's open the SYSTEM hive into Registry Explorer.

Cache Entry Positions are stored in chronological order, with the most recent entries at the top. This allows investigators to quickly see the most recent applications executed before a system shutdown or reboot. By examining the order of entries, forensic analysts can reconstruct a timeline of application executions, helping to identify when specific actions were taken on the system. Alternatively, we can utilize the results obtained from RegRipper.

We can also use a tool called **`AppCompatCacheParser`**. ```bash AppCompatCacheParser.exe -f C:\Cases\Analysis\Registry\SYSTEM --csv C:\Cases\Analysis\Execution ```

Let's open this file using Timeline Explorer.

The Timeline Explorer confirms whether the executable was executed. ## Overview of the Amcache **Registry:** C:\Windows\AppCompat\Programs\Amcache.hve The **Amcache.hve** file, located in the `C:\Windows\AppCompat\Programs` directory, is a forensic goldmine for investigating application execution on Windows systems. It serves as a database containing metadata about executables and other application-related artifacts that have been run on the system. Unlike ShimCache, the Amcache records detailed metadata, often linked to executables that were executed rather than just accessed. Let's open Amcache.hve using Registry Explorer.

We can also use a tool called AmcacheParser. ```bash AmcacheParser.exe -f C:\Cases\E\Windows\AppCompat\Programs\Amcache.hve --csv C:\Cases\Analysis\Execution ```

Let's open "UnassociatedFileEntries" file using Timeline Explorer.

## Windows Prefetch analysis with PECmd **Path:** `C:\Windows\Prefetch\*.pf` Windows Prefetch is a performance optimization feature designed to speed up the loading of applications by caching information about their execution. From a forensic perspective, Prefetch files provide valuable evidence of program execution, helping investigators identify what programs were run, when, and how often. Prefetch files can provide evidence of program execution, even if the application has been deleted. This can be crucial in malware investigations and timeline analysis.

Let's use PECmd to examine the contents of the prefetch file "ATOMICSERVICE.EXE-CFFBD82A." ```bash PECmd.exe -f C:\Cases\E\Windows\prefetch\ATOMICSERVICE.EXE-CFFBD82A.pf ```

## Windows Prefetch Timeline Analysis ```bash PECmd.exe -d C:\Cases\E\Windows\prefetch --csv C:\Cases\Analysis\Execution ```

Let's open "PECmd\_Output.csv" using Timeline Explorer.

Next, let's open "PECmd\_Output\_Timeline" using Timeline Explorer.

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://faresbltagy.gitbook.io/footprintinglabs/practical-windows-forensics/analyzing-evidence-of-program-execution.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.