Windows application compatibility

sysmain.sdb

System compatibility database.

RecentFileCache.bcf

In Windows 7 the RecentFileCache.bcf file is stored in:

C:\Windows\AppCompat\Programs\

Amcache.hve

See: AMCache

AppCompatCache

In Windows 2000 and XP:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility

In Windows 2003 and later:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

External Links

• Demystifying Shims - or - Using the App Compat Toolkit to make your old stuff work with your new stuff, by Microsoft
• Application Compatibility Database, by Microsoft
• Secrets of the Application Compatilibity Database (SDB) – Part 1, by Alex Ionescu, May 20, 2007
• Secrets of the Application Compatilibity Database (SDB) – Part 2, by Alex Ionescu, May 21, 2007
• Secrets of the Application Compatilibity Database (SDB) – Part 3, by Alex Ionescu, May 26, 2007
• Leveraging the Application Compatibility Cache in Forensic Investigations by Andrew Davis, May 4, 2012
• Revealing Program Compatibility Assistant HKCU AppCompatFlags Registry Keys, by Corey Harrell, December 17, 2013
• Persist It Using and Abusing Microsoft’s Fix It Patches, by Jon Erickson, BlackHat Asia 2014
• To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence

RecentFileCache

• Revealing the RecentFileCache.bcf File, by Corey Harrell, December 2, 2013
• Triaging with the RecentFileCache.bcf File, by Corey Harrell, April 21, 2014