# ShimCache vs Amcache vs Prefetch: Which One Proves Execution?

URL: https://www.mytechnician.tech/labs/shimcache-vs-amcache-vs-prefetch-execution-evidence/
Published: 2026-08-08 | Author: Ankit Kumar
Track: Forensic artifact | Difficulty: Intermediate | Authorization: defensive
Time required: 25 min
Verified on: Windows 11 24H2 (build 26100.2894), Hyper-V VM on an internal-only virtual switch
MITRE ATT&CK: T1057
Tags: Forensics, Execution Artifacts, Registry, Detection
Summary: Three Windows artifacts get treated as interchangeable evidence that a program ran. Only one of them actually proves it. Here is what each records on Windows 11 and how to read them together.

## The Short Answer

**Prefetch proves execution. ShimCache and Amcache prove presence.**

Almost every wrong conclusion in this area comes from collapsing that distinction. If you only remember one thing, remember that a ShimCache entry is Windows saying "I looked at this file", not "I ran this file".

## Side by Side

| | Prefetch | ShimCache | Amcache |
|---|---|---|---|
| **Proves** | Execution | Presence at a path | Presence, with hash |
| **Location** | `C:\Windows\Prefetch\*.pf` | `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache` | `C:\Windows\AppCompat\Programs\Amcache.hve` |
| **Run count** | Yes | No | No |
| **Execution times** | Last 8 | No | No |
| **File hash** | No | No | SHA-1 |
| **Timestamp meaning** | Actual run times | File's last-modified time | When Windows catalogued it |
| **Written when** | On each run | Flushed at shutdown | On inventory sweep |
| **Capacity** | 1024 files | ~1024 entries | Trimmed by scheduled task |
| **Parser** | PECmd | AppCompatCacheParser | AmcacheParser |

## The Timestamp Trap

This is where findings go wrong most often, so it is worth being explicit.

**ShimCache's timestamp is not an execution time.** It is the `$STANDARD_INFORMATION` last-modified time of the file, copied into the cache. A binary compiled in 2019 and dropped on a machine yesterday will carry a 2019 timestamp in ShimCache. Reporting that as "executed in 2019" is a serious error and one that is easy to make, because the column is often labelled just "LastModifiedTime".

What ShimCache *does* give you is **order**. Entries are stored most-recent-operation-first. Position in the list tells you the sequence in which Windows encountered files, which is frequently more valuable than any timestamp — you can bracket an unknown binary between two known ones.

**Amcache's `FileKeyLastWriteTimestamp`** is approximately when the file was first catalogued, which is usually close to when it arrived on the machine. That is genuinely useful for "when did this appear".

**Prefetch timestamps are real execution events.** Eight of them, plus a count.

## The Shutdown Problem

ShimCache lives in memory during a session and is written to the registry **at shutdown**. Three consequences:

1. On a live machine, the registry copy does not include the current session. Anything that happened since boot is in memory only.
2. A machine that crashed or was hard-powered-off may have lost its most recent cache entirely.
3. If you need the current session's ShimCache, you need a memory capture, not a registry read.

This alone is a reason to prefer Prefetch and Amcache for live triage and to treat ShimCache as the artifact you consult after imaging.

## Reading Them Together

The combinations are more informative than any single source:

**Amcache present, Prefetch present, ShimCache present.** File arrived, was catalogued, ran. High confidence.

**Amcache present, Prefetch absent.** File was on disk and may never have run. Common for staged payloads and for tools an attacker dropped but did not need. Check whether Prefetch is even enabled before concluding this.

**ShimCache present, Amcache absent, Prefetch absent.** Windows enumerated the file — often during a scan or a directory listing — and nothing more. Weakest signal of the three. Frequently just noise.

**Prefetch present, Amcache absent.** Ran before the inventory task next ran, or the Amcache record was trimmed. Not suspicious on its own.

**All three absent, but you have other evidence it ran.** Consider whether the machine was reset, whether Prefetch is disabled, and how far back each artifact's retention actually reaches on this specific machine.

## A Practical Order

1. **Prefetch first.** Fastest to parse, strongest claim, and it names the directories the binary loaded from.
2. **Amcache second.** Get hashes for anything unrecognised, including things Prefetch did not see.
3. **ShimCache last, and only from an image.** Use it for ordering and for files the other two missed.

Then reconcile against [BAM for user attribution](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/) and, if network volume matters, [SRUM](https://www.mytechnician.tech/labs/srum-srudb-dat-windows-11-forensics/).

## Related

- [Prefetch on Windows 11](https://www.mytechnician.tech/labs/prefetch-files-windows-11-proving-execution/)
- [Amcache.hve on Windows 11](https://www.mytechnician.tech/labs/amcache-hve-windows-11-forensics/)
- [Windows 11 forensic artifacts overview](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/)

## FAQ

### If I can only check one, which should it be?

Prefetch. It is the only one of the three that proves execution, it carries a run count and eight timestamps, and it parses in seconds. Its weakness is retention (1024 files) and the possibility of being disabled — check `EnablePrefetcher` before treating an absent `.pf` as meaningful.

### Why does ShimCache show a file I know was never run?

Because that is what ShimCache does. The AppCompat infrastructure enumerates files during directory operations, installer activity, and scans. An entry means Windows encountered the file's metadata, nothing more. This is the artifact's normal behaviour, not an anomaly.

### Can an attacker clear these?

All three are deletable with administrator rights, and some tooling does exactly that. But clearing is itself evidence: an empty Prefetch folder on a long-running machine, a ShimCache with implausibly few entries, or a missing Amcache hive all stand out immediately against a normal baseline. Absence of expected artifacts is a finding, not a dead end.

### Do these artifacts exist on Windows 10 as well?

Yes, all three, with the same broad meanings. The structural details differ — Amcache's key layout changed at Windows 10 1607, and ShimCache's entry format has changed several times across releases. Use a parser that detects the version rather than reading raw offsets from an older reference.

---

Source: https://www.mytechnician.tech/labs/shimcache-vs-amcache-vs-prefetch-execution-evidence/ — My Technician Security Labs.
Authorization: defensive. This write-up is published for defensive and educational use on systems you own or are authorized to test.
More labs: https://www.mytechnician.tech/labs/