Posts tagged: #recentfilecache

The BCF's lifecycle is one scheduled task. Understand when ProgramDataUpdater runs, when it clears the file, and how to spot a disabled appraiser.

The BCF format is a header, a list of length-prefixed UTF-16LE paths, and that's it. Here is what every byte means and why nothing has changed since 2009.

A SOC-flagged Win7 endpoint, 14 paths in the BCF, three worth a second look. A realistic corroboration chain and how much the BCF actually contributed.

No timestamps, no hashes, no user attribution, no script tracking. The RecentFileCache.bcf is narrower than its reputation. Here is what to reach for.

A short, specific artifact that only exists on Windows 7 and Server 2008 R2 — but when you have it, it's one of the cleanest proofs of recent execution in DFIR.

The BCF and the AmCache solve overlapping problems on different Windows versions. Knowing which one you have, and why, decides what you can claim.

Practical guide to pulling RecentFileCache.bcf in three settings: a running Windows 7 endpoint, a forensic disk image, and a Volume Shadow Copy.

How attackers suppress, poison, or wipe RecentFileCache.bcf — and the event-log, scheduled-task, and filesystem signals that catch them doing it.

A practical guide to the path heuristics, basename oddities, and drive patterns that turn a list of cached paths into investigative leads.

What to do after a suspicious entry surfaces: how to confirm execution, what to cross-reference, and the false-positive patterns that catch analysts off guard.

Walking through the Windows 7 service and scheduled task that write RecentFileCache.bcf, and what that lifecycle means for triage windows.

A hands-on read of the RecentFileCache.bcf binary format with a hex dump, a decoded record, and the edge cases a parser has to handle.

Four Windows evidence-of-execution artifacts side-by-side: what each one stores, what it doesn't, and which one to reach for first.

A short primer on the Windows 7 AppCompat artifact: where it lives, what it records, and why it still shows up in 2026 triage cases.