Windows 11 Forensic Artifacts: Where Evidence of Program Execution Lives

The Question This Answers

Someone hands you a laptop and says a program was run on it — a remote access tool, a miner, something a scam caller installed. The program has since been deleted. Task Manager shows nothing. The Downloads folder is empty.

Windows still knows. It records execution in at least six independent places, none of which the average person clearing tracks thinks to touch. The problem is that those six places record different things, and treating them as interchangeable is the single most common mistake in this kind of work.

This is the map. Each of the individual artifacts has its own deep-dive lab linked below.

Before You Start: Presence Is Not Execution

The distinction that matters most:

• Execution evidence — the operating system observed this program run. Prefetch, UserAssist, BAM.
• Presence evidence — this file existed at this path at some point. ShimCache, Amcache.

ShimCache in particular is misread constantly. An entry means Windows looked at the file — often during a directory listing, an installer scan, or an antivirus sweep. It does not mean the binary ran. Claiming otherwise is how findings fall apart under scrutiny.

The Six Artifacts

Prefetch — strongest single execution proof

Windows writes a .pf file the first time a program runs, then updates it on every subsequent run. It stores the run count, the last eight execution timestamps, and the files the program loaded in its first ten seconds.

C:\Windows\Prefetch\NOTEPAD.EXE-8C4B2F3A.pf

Two caveats. Prefetch is disabled by default on SSD-backed systems in some configurations — check HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher before you conclude an absent .pf means the program never ran. And the folder caps at 1024 entries, so on a busy machine older evidence rolls off.

Full detail: Prefetch files on Windows 11.

Amcache.hve — presence, plus a hash

A registry hive at C:\Windows\AppCompat\Programs\Amcache.hve. Its value is the SHA-1 of the PE file, which means you can identify a deleted binary that you no longer have, and look that hash up.

It records files Windows encountered. Not necessarily files that ran.

Full detail: Amcache.hve on Windows 11.

ShimCache (AppCompatCache) — presence and a path

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Stores file path and the file's last-modified time. Critically, on modern Windows the cache is written to the registry at shutdown, so the live registry may not reflect what happened since the last boot. Entries are ordered by recency of the operation that created them, which is often more useful than their absent timestamps.

UserAssist — a human clicked this

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Per-user, GUI launches only, with run count and total focus time. Values are ROT13-encoded, which trips up anyone grepping the hive raw.

This is the artifact that distinguishes "a program executed" from "a person double-clicked a program". A miner launched by a scheduled task will not appear here. A pirated installer someone opened will.

BAM / DAM — last execution, per user

HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>

Background Activity Moderator. One entry per executable path, holding the last execution time, filed under the SID of the user who ran it. No run count and no history — just "this ran, at this time, as this user". Roughly a week of retention.

Its strength is attribution. Two accounts on the machine, and BAM tells you which one.

SRUM — resource use over 30 days

C:\Windows\System32\SRU\SRUDB.dat

The System Resource Usage Monitor logs per-application CPU cycles, and bytes sent and received per application, in roughly hourly buckets, for about 30 days. It is the only standard artifact that ties a program to network volume.

If the question is "was this thing exfiltrating data" or "what was pinning the CPU at 3am last Tuesday", SRUM answers it and nothing else does.

Full detail: SRUM on Windows 11.

Which One To Trust

| Question | Artifact | |---|---| | Did this program run at all? | Prefetch, then BAM | | How many times, and when? | Prefetch (run count + last 8 times) | | Which user ran it? | BAM, UserAssist | | Did a person launch it, or a task? | UserAssist (person) vs its absence | | What was the file, if it's deleted? | Amcache (SHA-1) | | Did it move data over the network? | SRUM | | Did the file merely exist here? | ShimCache, Amcache |

Read them together. A single artifact is a data point; three that agree is a finding.

What Breaks the Picture

• A reinstall or reset wipes all of it. Establish that first, before spending an hour on artifacts from a machine that was reimaged last week.
• Timestamps are local time in some tools and UTC in others. Normalise to UTC before building a timeline, or you will produce a two-hour gap that does not exist.
• Anti-forensics is uncommon but real. An empty Prefetch folder on a machine with months of uptime is itself the finding.

Where To Go Next

If you are triaging a live machine right now, start with the 30-minute triage lab instead — it sequences these artifacts by how fast they pay off.

If the concern is specifically that someone connected remotely, remote access artifacts is the more direct path.

If you are cleaning rather than investigating, the consumer guide for removing malware from Windows 11 is the right tool.

FAQ

Does deleting a program remove these artifacts?

No. Uninstalling removes the binary and usually its registry keys, but Prefetch files, ShimCache entries, Amcache records, and BAM entries persist independently. That asymmetry is exactly what makes them useful — they outlive the thing they describe.

Can I check these artifacts on a machine that is still running?

Yes for most of them, with caveats. The registry-based artifacts (ShimCache, UserAssist, BAM, Amcache) are readable live, but ShimCache is only flushed to the registry at shutdown, so recent activity may be missing. Prefetch and SRUM are readable live. If the machine is part of anything serious, image it first — every minute it runs overwrites something.

Why do two artifacts show different times for the same program?

Because they record different events. ShimCache stores the file's last-modified timestamp, not an execution time. Amcache records when Windows first catalogued the file. Prefetch records actual runs. A gap between them is normal and often informative — a file modified in March but first executed in August tells a story.

Is any of this admissible?

Artifact analysis is standard practice in incident response and is used in legal proceedings, but admissibility depends on chain of custody, imaging methodology, and jurisdiction — none of which this article covers. If the answer matters legally, image the drive with a write blocker and involve someone qualified before you touch the live system.