RecentFileCache vs Amcache vs Prefetch vs ShimCache

"Evidence of execution" is a job done by several Windows artifacts, not one. They overlap, contradict, and age out at different rates. This post puts the four most useful ones on the same table so you stop guessing which to open first.

At a glance

Artifact	Location	Windows	Granularity	Per-entry timestamps	Rich metadata	Survives reboot
RecentFileCache	`C:\Windows\AppCompat\Programs\RecentFileCache.bcf`	7 only	Path only	No (file mtime only)	None	Yes
Amcache	`C:\Windows\AppCompat\Programs\Amcache.hve`	7 to 11	Per-entry registry key	Yes (key LastWritten, more)	Path, SHA-1, PE, publisher, install date	Yes
Prefetch	`C:\Windows\Prefetch\*.pf`	XP to 11	Per executable file	Yes (last 8 runs on Win10+)	Run count, referenced files, volume info	Yes (auto-prunes to ~1024 entries on Win10+)
ShimCache	`SYSTEM` hive: `ControlSet\Control\Session Manager\AppCompatCache`	XP to 11	Per executable, in-memory until shutdown	LastModified (file), not exec time	None	Only on clean shutdown

What each one actually answers

RecentFileCache.bcf answers "what executables crossed the Application Experience scanner since the last ProgramDataUpdater run?" Cheap to parse, no metadata, Win7 only.

Amcache.hve answers "what programs and files have been installed or executed on this machine, with hashes and publisher info, since the OS was installed?" The closest thing to a system-wide installed-and-executed log on modern Windows.

Prefetch answers "what was actually executed, when, and how many times, for the most recent ~1024 binaries?" Tightest per-execution evidence available without dedicated logging.

Shimcache answers "what executables has the AppCompat shim infrastructure seen, and when was each one last modified?" The Shimcache timestamp is the file's LastModified, not the execution time. This is the field most often misread in DFIR reports. I have seen otherwise good analysts present Shimcache timestamps as execution times in court. Do not be that analyst.

When to reach for which

Short triage flow for "did binary X execute":

Prefetch first. If *X*.pf exists, you have an execution event with timestamp(s) and a run counter. Done.
Amcache. If a SHA-1 in InventoryApplicationFile matches your file, AppCompat at minimum saw the file. Combined with Prefetch this is high-confidence execution evidence.
RecentFileCache (Win7 only). If you are on Win7 and Amcache is sparse, the BCF is sometimes the only place a recent path landed. Treat as "seen by AppCompat between the last two ProgramDataUpdater runs."
Shimcache. Corroborating evidence. Presence is roughly "the AppCompat infrastructure saw a file at this path with this LastModified." Do not read its timestamp as an execution time.

A worked Win7 scenario

An analyst lands on a compromised Win7 box. The attacker dropped C:\Users\Public\update.exe, ran it once, then deleted it. The system was powered off the next morning.

What survives?

Prefetch. UPDATE.EXE-XXXXXXXX.pf likely present, with the execution timestamp embedded. Strongest single signal.
Shimcache. Entry present with the file's pre-deletion LastModified. Confirms AppCompat observed the path. Does not tell you when it ran.
Amcache. If ProgramDataUpdater fired between the execution and shutdown, an InventoryApplicationFile key exists with the SHA-1, publisher (or absence thereof), and the registry key's LastWritten time as the closest-to-execution timestamp on offer.
RecentFileCache. Path present if ProgramDataUpdater had not yet promoted it to Amcache. If promotion ran, the path is gone from the BCF and present in the hive.

So the same execution leaves traces in four places, each telling a slightly different story. None of them, alone, is unambiguous execution evidence. Read together, they triangulate.

That triangulation is the whole game on Win7. A path-only artifact (BCF) plus a hash-bearing artifact (Amcache) plus a time-bearing artifact (Prefetch) gives you identity, presence, and timing. Drop any one of the three and you start writing softer language in the report.

Common contradictions and what they mean

Prefetch present, BCF absent. Either the BCF was rewritten after a ProgramDataUpdater run (normal), or the BCF was tampered with (less normal). Check the BCF's LastWriteTime against the Prefetch's last-run time.
BCF present, Prefetch absent. Prefetch may be disabled on the volume, or the binary ran with Prefetch evasion. Both are interesting.
Amcache present, BCF absent, Prefetch absent. ProgramDataUpdater ran and promoted; Prefetch rolled the entry out or never created one. Common on aged-out evidence.
Shimcache disagrees with Amcache LastWritten. Expected. Shimcache stores file modification; Amcache LastWritten stores registry-key modification.