Difference between pages "Academic Forensics Programs - Graduate Level" and "Windows Application Compatibility"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(sysmain.sdb)
 
Line 1: Line 1:
==US Programs==
+
{{expand}}
* California Sciences Institute
+
* [http://www.ini.cmu.edu/degrees/pgh_msin/index.html Carnegie Mellon University]
+
* Dartmouth College
+
* George Mason University
+
* George Washington University
+
* [http://www.jjay.cuny.edu/690.php John Jay College]
+
* [http://www.forensic.msu.edu/ Michigan State University]
+
* Mississippi State
+
* Naval Postgraduate School
+
* Polytechnic Institute of New York University
+
* [http://cyberforensics.purdue.edu/  Purdue University]
+
* Sam Houston State University
+
* Stevenson University
+
* Texas State University
+
* [http://ncfs.ucf.edu/ University of Central Florida]
+
* University of Massachusetts, Amherst
+
* University of Mississippi
+
* University of New Haven
+
* [http://cs.uno.edu/research/ia.htm University of New Orleans]
+
* [http://forensics.cs.uri.edu/ University of Rhode Island]
+
* University of Texas at San Antonio
+
* Utica College [http://www.onlineuticacollege.com/programs/bachelor-degrees.asp [Online]]
+
* [http://www.cis.utulsa.edu/ Center for Information Security University of Tulsa]
+
* [http://forensics.wvu.edu/ West Virginia University]
+
  
==Europe==
+
== sysmain.sdb ==
* [http://www.cranfield.ac.uk/cds/postgraduatestudy/forensiccomputing/index.jsp Cranfield University, UK]
+
System compatibility database.
* [http://www.lit.ie/departments/IT/MSC_Computing.html Limerick Institute of Technology]
+
* [http://www.studeren.uva.nl/ma-forensic-science University of Amsterdam]
+
* University of Bradford
+
* University of East London
+
* [http://cci.ucd.ie/fcci University College Dublin]
+
* [http://www.utm.ac.mu University of Technology, Mauritius]
+
* [http://www.strath.ac.uk/science/forensicinformatics/ University of Strathclyde]
+
* [http://www.glam.ac.uk/coursedetails/685/549 University of Glamorgan, Wales, UK]
+
  
==Asia==
+
== RecentFileCache.bcf ==
* [http://www.zu.ac.ae/main/en/colleges/colleges/college_information_technology/graduate_certificate_programs/cr_invest/intro.aspx Zayed University, UAE]
+
In Windows 7 the RecentFileCache.bcf file is stored in:
 +
<pre>
 +
C:\Windows\AppCompat\Programs\
 +
</pre>
  
==Africa==
+
== Amcache.hve ==
* [http://www.commerce.uct.ac.za/InformationSystems/Courses/inf4016w/ University of Cape Town]
+
The Amcache.hve file is a [[Windows NT Registry File (REGF)]].
  
==See Also==
+
In Windows 8 the Amcache.hve file is stored in:
* [http://www.aafs.org/default.asp?section_id=resources&page_id=colleges_and_universities AAFS]
+
<pre>
* [http://www.digitalforensicsassociation.org/formal-education/ Digital Forensics Association List]
+
C:\Windows\AppCompat\Programs\
* [http://www.forensicfocus.com/computer-forensics-education-directory Forensics Focus List]
+
</pre>
 +
 
 +
== AppCompatCache ==
 +
In Windows 2000 and XP:
 +
<pre>
 +
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility
 +
</pre>
 +
 
 +
In Windows 2003 and later:
 +
<pre>
 +
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
 +
</pre>
 +
 
 +
== External Links ==
 +
* [http://technet.microsoft.com/en-us/library/dd837644(v=ws.10).aspx Technet: Understanding Shims], by [[Microsoft]]
 +
* [http://msdn.microsoft.com/en-us/library/bb432182(v=vs.85).aspx MSDN: Application Compatibility Database], by [[Microsoft]]
 +
* [http://www.alex-ionescu.com/?p=39 Secrets of the Application Compatilibity Database (SDB) – Part 1], by [[Alex Ionescu]], May 20, 2007
 +
* [http://www.alex-ionescu.com/?p=40 Secrets of the Application Compatilibity Database (SDB) – Part 2], by [[Alex Ionescu]], May 21, 2007
 +
* [http://www.alex-ionescu.com/?p=41 Secrets of the Application Compatilibity Database (SDB) – Part 3], by [[Alex Ionescu]], May 26, 2007
 +
* [http://recxltd.blogspot.com/2012/04/windows-appcompat-research-notes-part-1.html Windows AppCompat Research Notes - Part 1], by Ollie, 28 April 2012
 +
* [http://recxltd.blogspot.com/2012/05/windows-appcompat-research-notes-part-2.html Windows AppCompat Research Notes - Part 2], by Ollie, 4 May 2012
 +
* [https://dl.mandiant.com/EE/library/Whitepaper_ShimCacheParser.pdf Leveraging the Application Compatibility Cache in Forensic Investigations], by [[Andrew Davis]], May 4, 2012
 +
* [http://journeyintoir.blogspot.ch/2013/12/revealing-recentfilecachebcf-file.html Revealing the RecentFileCache.bcf File], by [[Corey Harrell]], December 2, 2013
 +
* [http://journeyintoir.blogspot.ch/2013/12/revealing-program-compatibility.html Revealing Program Compatibility Assistant HKCU AppCompatFlags Registry Keys], by [[Corey Harrell]], December 17, 2013
 +
* [http://journeyintoir.blogspot.ch/2014/04/triaging-with-recentfilecachebcf-file.html Triaging with the RecentFileCache.bcf File], by [[Corey Harrell]], April 21, 2014

Latest revision as of 00:06, 9 July 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

sysmain.sdb

System compatibility database.

RecentFileCache.bcf

In Windows 7 the RecentFileCache.bcf file is stored in:

C:\Windows\AppCompat\Programs\

Amcache.hve

The Amcache.hve file is a Windows NT Registry File (REGF).

In Windows 8 the Amcache.hve file is stored in:

C:\Windows\AppCompat\Programs\

AppCompatCache

In Windows 2000 and XP:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility

In Windows 2003 and later:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

External Links