Search
Search every article on the RecentFileCache Parser blog. Filter by tag, title, or any keyword across the Windows DFIR and AppCompat coverage.
The Application Experience appraisal task: when the BCF gets written, and when it gets cleared
The BCF's lifecycle is one scheduled task. Understand when ProgramDataUpdater runs, when it clears the file, and how to spot a disabled appraiser.
The RecentFileCache.bcf file format, in plain terms
The BCF format is a header, a list of length-prefixed UTF-16LE paths, and that's it. Here is what every byte means and why nothing has changed since 2009.
Investigating a Win7 host with the BCF: a short walkthrough
A SOC-flagged Win7 endpoint, 14 paths in the BCF, three worth a second look. A realistic corroboration chain and how much the BCF actually contributed.
Limits of the BCF: when it tells you nothing, and what to use instead
No timestamps, no hashes, no user attribution, no script tracking. The RecentFileCache.bcf is narrower than its reputation. Here is what to reach for.
RecentFileCache.bcf: the quiet artifact most analysts forget about
A short, specific artifact that only exists on Windows 7 and Server 2008 R2 — but when you have it, it's one of the cleanest proofs of recent execution in DFIR.
RecentFileCache vs AmCache: which one is on your host, and why
The BCF and the AmCache solve overlapping problems on different Windows versions. Knowing which one you have, and why, decides what you can claim.
Acquiring RecentFileCache.bcf from live and offline systems
Practical guide to pulling RecentFileCache.bcf in three settings: a running Windows 7 endpoint, a forensic disk image, and a Volume Shadow Copy.
Detecting RecentFileCache tampering
How attackers suppress, poison, or wipe RecentFileCache.bcf — and the event-log, scheduled-task, and filesystem signals that catch them doing it.
Triage: spotting suspicious entries in RecentFileCache
A practical guide to the path heuristics, basename oddities, and drive patterns that turn a list of cached paths into investigative leads.
Validating RecentFileCache findings: pivots and false positives
What to do after a suspicious entry surfaces: how to confirm execution, what to cross-reference, and the false-positive patterns that catch analysts off guard.
Application Experience & ProgramDataUpdater: how .bcf gets populated
Walking through the Windows 7 service and scheduled task that write RecentFileCache.bcf, and what that lifecycle means for triage windows.
The .bcf format, byte-by-byte
A hands-on read of the RecentFileCache.bcf binary format with a hex dump, a decoded record, and the edge cases a parser has to handle.
RecentFileCache vs Amcache vs Prefetch vs ShimCache
Four Windows evidence-of-execution artifacts side-by-side: what each one stores, what it doesn't, and which one to reach for first.
What is RecentFileCache.bcf?
A short primer on the Windows 7 AppCompat artifact: where it lives, what it records, and why it still shows up in 2026 triage cases.