Execution
Syscache.hve
Syscache.hve cheat sheet: the Windows 7 / Server 2008 R2 hive in System Volume Information that links MFT file IDs to SHA-1 hashes, and its limits.
- Location
- C:\System Volume Information\Syscache.hve
- Proves
- An executable with this SHA-1 and MFT file ID was recorded on the volume
- Timestamps
- ObjectTable record key LastWrite as FILETIME, UTC; the only per-record time
- Retention
- No documented size limit; records can outlive the file; not removed by restore-point or shadow-copy cleanup; older versions in VSS
- Access
- System Volume Information is SYSTEM-only and the hive may be in use: collect via raw NTFS (KAPE Syscache) or from a VSS copy
- Evidence of
- ExecutionFile & folder access
- Type
- Registry
- Windows
- Vista / 7
- KAPE target
- Syscache
- Velociraptor
- Windows.Triage.Targets:Syscache
Tools
Compare all toolsWhat it is
Syscache.hve is a registry hive stored in the hidden System Volume Information folder. On Windows 7 and Windows Server 2008 R2 it is filled by the discache.sys driver with data pushed by the Application Experience service: for executables, it stores the NTFS file ID and a SHA-1 hash, similar to what Amcache does on later versions. It is less studied than Amcache, and its update behaviour has been observed to differ between Windows 7 and Server 2008 R2, so use it as corroboration.
Location
| Windows version | Path | Notes |
|---|---|---|
| 7 / Server 2008 R2 | C:\System Volume Information\Syscache.hve | With Syscache.hve.LOG1 / .LOG2; one per volume where it is created |
| 8 and later | — | Behaviour not publicly documented; rely on Amcache instead |
Inside the hive the records sit under DefaultObjectStore\ObjectTable\<id>.
System Volume Information is accessible only to SYSTEM, so collect it with raw NTFS access.
What it proves
- An executable identified by its SHA-1 and its MFT file reference was recorded on the volume.
- Because records point to the $MFT entry rather than to a path, you can resolve the path with the $MFT, as long as the entry has not been reused (check the sequence number).
- Published tests (David Cowen, 1234n6, Maxim Suhanov) observed entries created shortly after executions on Server 2008 R2, but not for every launch. Treat an entry as evidence of presence, and corroborate execution with other artifacts.
Key fields
| Value | Meaning |
|---|---|
_FileId_ | 64-bit NTFS file reference: MFT entry number and sequence number |
AeFileID | 0000 followed by the SHA-1 of the file (UTF-16 string) |
AeProgramID | Program identifier from the Application Experience inventory |
Other _..._ values | Object-store bookkeeping used by the driver |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
ObjectTable\<id> key LastWrite | The record is created or updated | FILETIME, UTC | The only per-record time; updates for other reasons move it |
Retention and clearing
- No documented size limit; records can outlive the file they describe.
- The file is protected by
System Volume Informationpermissions, which makes casual tampering unlikely, but a restore-point or shadow-copy cleanup does not remove it. - Older versions of the hive may exist inside volume shadow copies.
Collection
- KAPE target:
Syscache(hive and.LOG*files) - Velociraptor (
Windows.Triage.Targets):Syscache - Built-in: no simple native copy (the folder is SYSTEM-only and the hive may be in use); use a raw-access collector or read it from a shadow copy.
vssadmin list shadows
copy "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\System Volume Information\Syscache.hve" E:\case\
Parsing tools
- RegRipper:
syscacheplugin (file ID, sequence number, SHA-1 and LastWrite per record). - Registry Explorer (Eric Zimmerman): open the hive to browse
ObjectTable. - MFTECmd (Eric Zimmerman): resolve file IDs to paths using the
$MFTof the same volume.
Investigation tips
- Join
_FileId_to the$MFTentry and check that the sequence number matches before trusting the path. - Search every SHA-1 against known-bad lists and against Amcache data from other hosts.
- On a Windows 7 host, compare with RecentFileCache and ShimCache to build an execution picture.
- Because the behaviour is not fully documented, test your conclusions on a comparable system before stating them in a report.
Related artifacts
- Amcache.hveAmcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- Master File Table ($MFT)$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.
- ShimCache (AppCompatCache)ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
- RecentFileCache.bcfRecentFileCache.bcf cheat sheet: the Windows 7 execution artifact that lists recently run executables, its location, format, limits and how to parse it.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
Glossary terms
- MFT file reference numberThe 64-bit NTFS identifier of a file: a 48-bit MFT entry number plus a 16-bit sequence number that changes each time the entry is reused.
- Registry HiveAn on-disk file that backs part of the Windows Registry, such as `SYSTEM`, `SOFTWARE`, or `NTUSER.DAT`.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.