ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "Opera" and "Windows Application Compatibility"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(sysmain.sdb)
 
Line 1: Line 1:
 
{{expand}}
 
{{expand}}
  
== Data directory ==
+
== sysmain.sdb ==
Opera stores the user data in the following locations:
+
System compatibility database.
  
On Linux:
+
== RecentFileCache.bcf ==
 +
In Windows 7 the RecentFileCache.bcf file is stored in:
 
<pre>
 
<pre>
/home/$USER/.opera/
+
C:\Windows\AppCompat\Programs\
 
</pre>
 
</pre>
  
=== Global history ===
+
== Amcache.hve ==
The file '''global_history.dat''' is a text file.
+
The Amcache.hve file is a [[Windows NT Registry File (REGF)]].
  
 +
In Windows 8 the Amcache.hve file is stored in:
 
<pre>
 
<pre>
Welcome to Opera
+
C:\Windows\AppCompat\Programs\
http://www.opera.com/portal/upgrade/
+
1319089117
+
-1
+
 
</pre>
 
</pre>
  
Where the fields are:
+
== AppCompatCache ==
* Title
+
In Windows 2000 and XP:
* URL
+
<pre>
* date and time (32-bit POSIX or Unix epoch timestamp)
+
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility
 +
</pre>
  
=== Search field history ===
+
In Windows 2003 and later:
The file '''search_field_history.dat''' is an XML file that contains the history of queries typed in the search bar by the user.
+
<pre>
 
+
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
=== Typed history ===
+
</pre>
The file '''typed_history.xml''' contains the history of the URLs typed in the address bar by the user.
+
  
 
== External Links ==
 
== External Links ==
 
+
* [http://technet.microsoft.com/en-us/library/dd837644(v=ws.10).aspx Technet: Understanding Shims], by [[Microsoft]]
* [http://www.opera.com/ Official website]
+
* [http://msdn.microsoft.com/en-us/library/bb432182(v=vs.85).aspx MSDN: Application Compatibility Database], by [[Microsoft]]
* [http://www.opera.com/docs/operafiles/ Opera: Files used by Opera]
+
* [http://www.alex-ionescu.com/?p=39 Secrets of the Application Compatilibity Database (SDB) – Part 1], by [[Alex Ionescu]], May 20, 2007
 
+
* [http://www.alex-ionescu.com/?p=40 Secrets of the Application Compatilibity Database (SDB) – Part 2], by [[Alex Ionescu]], May 21, 2007
[[Category:Applications]]
+
* [http://www.alex-ionescu.com/?p=41 Secrets of the Application Compatilibity Database (SDB) – Part 3], by [[Alex Ionescu]], May 26, 2007
[[Category:Web Browsers]]
+
* [http://recxltd.blogspot.com/2012/04/windows-appcompat-research-notes-part-1.html Windows AppCompat Research Notes - Part 1], by Ollie, 28 April 2012
 +
* [http://recxltd.blogspot.com/2012/05/windows-appcompat-research-notes-part-2.html Windows AppCompat Research Notes - Part 2], by Ollie, 4 May 2012
 +
* [https://dl.mandiant.com/EE/library/Whitepaper_ShimCacheParser.pdf Leveraging the Application Compatibility Cache in Forensic Investigations], by [[Andrew Davis]], May 4, 2012
 +
* [http://journeyintoir.blogspot.ch/2013/12/revealing-recentfilecachebcf-file.html Revealing the RecentFileCache.bcf File], by [[Corey Harrell]], December 2, 2013
 +
* [http://journeyintoir.blogspot.ch/2013/12/revealing-program-compatibility.html Revealing Program Compatibility Assistant HKCU AppCompatFlags Registry Keys], by [[Corey Harrell]], December 17, 2013
 +
* [http://journeyintoir.blogspot.ch/2014/04/triaging-with-recentfilecachebcf-file.html Triaging with the RecentFileCache.bcf File], by [[Corey Harrell]], April 21, 2014

Revision as of 05:06, 9 July 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

sysmain.sdb

System compatibility database.

RecentFileCache.bcf

In Windows 7 the RecentFileCache.bcf file is stored in:

C:\Windows\AppCompat\Programs\

Amcache.hve

The Amcache.hve file is a Windows NT Registry File (REGF).

In Windows 8 the Amcache.hve file is stored in:

C:\Windows\AppCompat\Programs\

AppCompatCache

In Windows 2000 and XP:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility

In Windows 2003 and later:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

External Links