Shimcache: A Crucial Tool for Digital Forensics and Incident Response

Inception Security

Apr 28, 2023

3 min read

Updated: Oct 14

Shimcache, also known as the Application Compatibility Cache, is a feature in the Windows operating system that tracks application compatibility information. It records the programs Windows has checked for compatibility, allowing the operating system to optimize the loading of applications. From a digital forensics and incident response standpoint, shimcache can be a valuable source of information for investigating and understanding an attacker's or malware's actions. Below is how shimcache works and why it matters in an investigation.

Understanding Shimcache

When an application is executed on a Windows system, the operating system records it in the shimcache. This includes information such as the name of the application, the path of the executable file, and the file's last modified time from $STANDARD_INFORMATION. That timestamp is not the time the program ran. On Windows Vista, 7, Server 2008 and Server 2012, entries can also be written when a user browses a folder in Explorer, so an entry does not always mean the file ran. From Vista through Windows 8.1, each entry carries an execution flag that helps separate the two. Windows 10 and later have no documented execution flag (some parsers infer one from the entry data), so treat an entry as proof the file existed at that path and confirm execution with Prefetch, Amcache or event logs.

This information is stored in the shimcache as a series of records known as cache entries. Each cache entry includes the path of the executable file and its last modified time. Depending on the Windows version, an entry can also hold the file size and an execution flag. Shimcache does not store a hash of the file.

The Shimcache is in the SYSTEM hive in the directory C:\Windows\System32\config. The Registry key that is related to Shimcache is HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache, in the AppCompatCache value. The cache is held in memory and written to the registry when the system shuts down or reboots, so a live SYSTEM hive may not show the newest entries.

The Importance of Shimcache in Digital Forensics and Incident Response

Shimcache is useful in an investigation for several reasons:

Timeline of activity: Entries are stored with the most recent first, so by examining the shimcache, investigators can see the order in which programs were cached and use the last modified times to help build a timeline of activity on the system.
Evidence a file existed: Shimcache can show that a file was present at a given path even after the attacker deleted it. This is useful for understanding an attacker's or malware's actions, such as tools that were dropped and later removed.
Detection of malicious or unusual activity: Shimcache can help investigators identify malicious or unusual activity on the system. For example, if an unknown or suspicious application is found in the shimcache, it could indicate the presence of malware or an attempted attack.

Analyzing Shimcache

Several tools are available for analyzing shimcache, including Eric Zimmerman's AppCompatCacheParser and Mandiant's open-source tool, ShimCacheParser. These tools allow investigators to extract and analyze the contents of the shimcache, providing a detailed view of activity on the system.

Note that shimcache has been part of Windows since Windows XP, but the data it keeps changes between versions. Check which version you are looking at before you read anything into an entry, and use other sources of information, such as the prefetch folder, to back up what you find.

Conclusion

Shimcache is a valuable source of information for digital forensics and incident response investigations. It helps build a timeline of activity on the system, shows files that existed even after deletion, and can help investigators identify malicious or unusual activity. By using tools like AppCompatCacheParser and ShimCacheParser, investigators can extract and analyze the contents of the shimcache to piece together what an attacker or malware did on a system.