AppCompatCache 2026.10.1

AppCompatCacheParser

Command Line Interface

Description:
  AppCompatCache Parser version 2026.10.0

  Author: Eric Zimmerman (saericzimmerman@gmail.com)
  https://github.com/EricZimmerman/AppCompatCacheParser

Usage:
  AppCompatCacheParser [options]

Options:
  -f <f>          Full path to SYSTEM hive to process. If this option is not specified, the live Registry will be used
  --csv <csv>     Directory to save CSV formatted results to. Be sure to include the full path in double quotes
  --csvf <csvf>   File name to save CSV formatted results to. When present, overrides default name
  -c <c>          The ControlSet to parse. Default is to extract all control sets [default: -1]
  -t              Sorts last modified timestamps in descending order
  --dt <dt>       The custom date/time format to use when displaying time stamps. See https://goo.gl/CNVq0k for options [default: yyyy-MM-dd HH:mm:ss]
  --nl            When true, ignore transaction log files for dirty hives
  --debug         Show debug information during processing
  --trace         Show trace information during processing
  -?, -h, --help  Show help and usage information
  --version       Show version information

Examples: AppCompatCacheParser.exe --csv c:\temp -t -c 2
          AppCompatCacheParser.exe --csv c:\temp --csvf results.csv

          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

AppCompatCacheParser exits with 0 when the hive was processed, and 1 for bad arguments, a hive that can't be read (or is dirty without its transaction logs, unless --nl is given), no cache found, or a CSV that can't be written.

Output

Library

The AppCompatCache NuGet package parses the value from a hive, or the raw value:

var acc = new AppCompatCache.AppCompatCache(@"C:\Temp\SYSTEM", -1, false); //all control sets, replaying transaction logs
foreach (var cache in acc.Caches)
{
    foreach (var e in cache.Entries.Concat(cache.SlackEntries))
    {
        Console.WriteLine($"{e.ControlSet} {e.CacheEntryPosition} {e.Path} {e.LastModifiedTimeUTC} {e.Executed}");
    }

    foreach (var error in cache.ParseErrors) //entries that could not be read
    {
        Console.WriteLine(error);
    }
}

var fromValue = new AppCompatCache.AppCompatCache(File.ReadAllBytes("AppCompatCache.bin"), 1, false);

• A value that is too small or not a known format throws AppCompatCacheParseException. A damaged entry is listed in ParseErrors, and the entries before it (or, for the fixed size formats of Windows XP to 7, the others) are still returned.
• Windows 10/11 entry data is a list of (tag, size, value) records: Windows10.DataTags(entry.Data).

Documentation

AppCompatCache (ShimCache) parser. Supports Windows XP, Windows Server 2003, Vista and 2008, Windows 7 (x86 and x64), Windows 8.x, Windows 10, and Windows 11.

Introducing AppCompatCacheParser

AppCompatCacheParser v0.0.5.1 released

AppCompatCacheParser v0.0.5.2 released

AppCompatCacheParser v0.9.0.0 released and some AppCompatCache/shimcache parser testing

Windows 10 Creators update vs shimcache parsers: Fight!!

Updates to the left of me, updates to the right of me, version 1 releases are here (for the most part)

Everything gets an update, Sept 2018 edition

Locked file support added to AmcacheParser, AppCompatCacheParser, MFTECmd, ShellBags Explorer (and SBECmd), and Registry Explorer (and RECmd)

Windows Registry Knowledge Base

Download Eric Zimmerman's Tools

All of Eric Zimmerman's tools can be downloaded here.

Special Thanks

Open Source Development funding and support provided by the following contributors: SANS Institute and SANS DFIR.