Standalone C# Tool for live Windows AMCache parsing. Handles live and locked Win10 and 11 Hives!
⭐ Star this project if you found it useful.
Vortex AMCache Analyzer is a robust .NET tool for forensic analysis of Windows AMCache Hive in Win10 and Win11. Reads and interprets AmCache hive data, fixes version quirks, extracts all forencis artifacts and metadata resolution (timestamps, hashes, signatures).
- Loads and parses AMCache Hive
- Auto-detects and adjusts Win10/11 schema variations
- Extracts File Entries, Shortcuts, Device History and Driver Information
- Resolves file paths and volume serial mappings
- File checks: Timestamps, SHA1, Authenticode signature validation
- Status flags: Installed/Removed/Unknown
- Dependency Resolution: Programs/files/volumes with normalized paths
- Executable Metadata: SHA1, signature status, timestamps
- Reflection Helpers: Dynamic property access for parser objects
- No External Dumps: Live Hive reading
- .NET Framework 4.6.2
- Windows 10 or Windows 11
- Administrator privileges (for protected file access)