Are we going to stop calling it Amcache??
Brief
I was poking around my system recently and noticed something that’s slightly different with the Amcache folder
It looks like C:\windows\appcompat\programs now has a few more files than before!
I’ve only done a few quick checks, but it looks like there are SQLite databases for each of the previous registry sections found within Amcache. Hve. I don’t know which version this came in, because I havent done a major update recently, and I don’t see anything obvious in the update history or changelog.
If you have a look at a standard Amcache hive you’ll notice the similarity.
Looking at the schemas, not much appears to be different. There is a timestamp, LastModified, which is a FILETIME timestamp; This seems like it’s going to replace the registry last write time for our use case.