RecentFileCache.bcf Cheat Sheet

What it is

RecentFileCache.bcf is a small binary file maintained by the Application Experience service on Windows 7 and Windows Server 2008 R2. It lists the full paths of executables that were recently started, so the compatibility inventory can later examine them. It is the predecessor of Amcache.hve, which replaced it from Windows 8 onwards.

Location

Windows version	Path
7 / Server 2008 R2	`C:\Windows\AppCompat\Programs\RecentFileCache.bcf`
8 and later	Not used (Amcache.hve instead)

On Windows 7 systems that received the compatibility updates bringing Amcache, both files can exist side by side.

What it proves

An executable at the listed path was launched recently, that is, since the cache was last processed.
It is valuable for programs run from removable media or temporary folders, which it records with their full path.
It does not contain timestamps, run counts or user information.

Key fields

Field	Meaning
Header	Signature and format information
Entry length	Length of the following path in characters
Path	Full UTF-16 path of the executable (lower-case in practice)

That is the whole record: a list of paths.

Timestamps

Timestamp	Set when	Format	Pitfalls
None inside the file	—	—	Entries carry no time of their own
File $SI modification time	Last update of the cache	NTFS, UTC	Only brackets the most recent write; use the $MFT and the USN journal for the history of writes

Retention and clearing

The cache is periodically emptied when the Application Experience inventory task (ProgramDataUpdater) processes it, so it usually covers a short window of recent executions.
Because of this short window, it is best at catching activity shortly before acquisition; older entries may survive in shadow copies of the file.

Collection

KAPE target: RecentFileCache
Velociraptor (Windows.Triage.Targets): RecentFileCache
Built-in:

robocopy C:\Windows\AppCompat\Programs E:\case\AppCompat RecentFileCache.bcf /COPY:DAT

Parsing tools

RecentFileCacheParser (Eric Zimmerman): RecentFileCacheParser.exe -f RecentFileCache.bcf --csv E:\out.
rfc.pl (Perl script by Corey Harrell): prints the list of paths.
A hex editor is enough for a quick look: the paths are plain UTF-16.

Investigation tips

Every path is a lead: look for executables in \Users\<user>\AppData\Local\Temp\, \Users\Public\, removable-drive letters and network paths.
Take each path to the $MFT, ShimCache and Prefetch to add timestamps and confirm execution.
If the binary still exists, triage it as a PE file (hash, signature, compile time).
On a Windows 7 host that also has Amcache, compare both lists: an executable present in one but not the other narrows down when it ran.

RecentFileCache.bcf

Tools