Where Is the Windows Shimcache (AppCompatCache)?
Windows Shimcache in the SYSTEM hive under Session Manager AppCompatCache with execution traces.
Last updated
Windows records executables that ran on the machine in the Shimcache, a registry value inside the SYSTEM hive used by application compatibility. Path, size and last-modified stamps survive here long after files delete.
Forensics timelines lean on it for execution evidence without a prefetch entry. Parse the offline hive since the live key stays locked.
Where Windows stores this, by platform
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
The AppCompatCache value holds the binary cache; read the SYSTEM hive file at C:\Windows\System32\config\SYSTEM from a disk image. Entries prove execution with timestamps but no run counts. Pair with prefetch and UserAssist for the full story.
Frequently asked questions
What does Shimcache prove?
That a binary executed on the machine, with its path and timestamps. It does not show how often or by whom.
How do I read Shimcache?
Export the SYSTEM hive offline and parse AppCompatCache with a forensics tool. The raw binary is version-dependent and unreadable by eye.
Notice an outdated path? Let us know.