shimcache#

$ target-query <path/to/target> -f shimcache
Details#

Module

os.windows.regf.shimcache.ShimcachePlugin

Output

records

Module documentation

Shimcache plugin.

Function documentation

Return the shimcache.

The ShimCache or AppCompatCache stores registry keys related to properties from older Windows versions for compatibility purposes. Since it contains information about files such as the last modified date and the file size, it can be useful in forensic investigations.

References:
Yields ShimcacheRecords with the following fields:

hostname (string): The target hostname. domain (string): The target domain. last_modified (datetime): The last modified date. name (string): The value name. index (varint): The index of the entry. path (uri): The parsed path.