Skip to content

Files

Latest commit

d2984f1 · Mar 1, 2020

History

History

AmCache

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
Mar 1, 2020
Mar 1, 2020
Jul 21, 2018
Jul 21, 2018
Jul 22, 2018

Windows 10 (1703+) AmCache.hve

  • AmCache.ps1 Powershell script to parse the entries in

    AmCache.hve::Root/InventoryApplicationFile/

    User can select all lines (Ctrl+A) or specific lines (Ctrl+click) and copy/paste (Ctrl+C and Ctrl+V) the data to a text file or MS Excel spreadsheet. The Selected lines are also displayed in the console after the user presses the OK button.

  • AmCache1.ps1 Powershell script to parse the entries in the following keys of AmCache.hve

    AmCache.hve::Root/InventoryApplication/ and
    AmCache.hve::Root/InventoryApplicationFile/

    preview1

    User can select all lines (Ctrl+A) or specific lines (Ctrl+click) and copy/paste (Ctrl+C and Ctrl+V) the data to a text file or MS Excel spreadsheet. The Selected lines are also displayed in the console after the user presses the OK button.

    preview2