Description:
============:
This course will examine the AmCache hive file, which stores information relating to the execution of applications.

Full Description:
================:
A forensic examination of the AmCache hive file showing the following: application installation, application first run date and time, a file path to the executable file, the source of the application, a SHA-1 hash value of the executable file, plug-and-play connected devices, GUIDs of mounted volumes and system hardware information.