Skip to content
RecentFileCache

Posts tagged: #program-execution

← Back to all posts
The Application Experience appraisal task: when the BCF gets written, and when it gets cleared
The BCF's lifecycle is one scheduled task. Understand when ProgramDataUpdater runs, when it clears the file, and how to spot a disabled appraiser.
recentfilecachescheduled-tasksdfirwindows-forensics
Limits of the BCF: when it tells you nothing, and what to use instead
No timestamps, no hashes, no user attribution, no script tracking. The RecentFileCache.bcf is narrower than its reputation. Here is what to reach for.
recentfilecachedfirwindows-forensicsartifact-limitations
RecentFileCache.bcf: the quiet artifact most analysts forget about
A short, specific artifact that only exists on Windows 7 and Server 2008 R2 — but when you have it, it's one of the cleanest proofs of recent execution in DFIR.
recentfilecachewindows-forensicsdfirprogram-execution
RecentFileCache vs AmCache: which one is on your host, and why
The BCF and the AmCache solve overlapping problems on different Windows versions. Knowing which one you have, and why, decides what you can claim.
recentfilecacheamcachewindows-forensicsdfir