Skip to content
RecentFileCache

Posts tagged: #reverse-engineering

← Back to all posts
The RecentFileCache.bcf file format, in plain terms
The BCF format is a header, a list of length-prefixed UTF-16LE paths, and that's it. Here is what every byte means and why nothing has changed since 2009.
recentfilecachefile-formatdfirwindows-forensics
The .bcf format, byte-by-byte
A hands-on read of the RecentFileCache.bcf binary format with a hex dump, a decoded record, and the edge cases a parser has to handle.
dfirwindows-forensicsrecentfilecachefile-format