shimcache

Here are 5 public repositories matching this topic...

KrishnenduOfficial / winforensics-correlator

A fast, cross-artifact Windows forensic timeline correlator in Python. Automatically stitches fragmented telemetry from MFT, SRUM, Shimcache, and BAM to spot timestomping, ghost execution, and account-level activity in one unified timeline.

incident-response dfir threat-hunting digital-forensics timeline-analysis srum windows-forensics shimcache timestomping

Updated Sep 19, 2026
Python

ayinedjimi / ShimCacheDatabaseParser

Star

C++ ShimCache (AppCompatCache) parser for execution artifact forensics

cpp incident-response dfir digital-forensics windows-security shimcache

Updated Feb 20, 2026
C++

Devzinh / GhostTrace

Star

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks correlation. 20+ modules mapped to MITRE ATT&CK.