cargo / amcache-core

amcache-core

cargo

Pure-Rust read-only Windows Amcache.hve reader — decodes the modern (Windows 10/11) InventoryApplicationFile execution-evidence entries (path, SHA-1, publisher, size, link date) and InventoryDevicePnp device entries from an Amcache hive.

0 audits github.com/SecurityRonin/amcache-forensic

Audits

No audits for this package yet.