Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Program execution timeline
View program execution timeline
Reset Windows Password v14.2
Telegram data recovery, Photo Database and Media Player investigation tools, and some more
Office password recovery tools
Resetting VBA passwords
New blog post
Dumping the history of users' IP addresses in Windows
Reset Windows Password v14.1
IP addresses history viewer, fast disk search, local security editor and some more

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: view program execution timeline

It would not be a big surprise to know that there are a lot of artifacts that contain information about recently opened documents or launched files in Windows. The AMCache is one of them, which stores data about every program that has been started or installed in the system earlier. The AMCache is available starting with Windows 7. Older operating systems use a BCF format to save data about executed programs. Physically, both formats are simple files located in the '%WINDIR%\appcompat\Programs' folder. The AMCache.hve is a registry hive that provides a timeline of which program was executed and when, while the RecentFileCache.bcf stands for a simple Binary Cache File.

The program supports both formats, however, the old BCF format contains no information about the execution time.


Choosing Windows directory

Program execution timeline - choosing Windows directory

Select the Windows directory detected by the program.


View program execution timeline

View program execution timeline

Now it's time to hit the << SEARCH FILES >> button and wait for the program to locate the files to fill in the table.

In order to wipe out any unnecessary file from the list of found items, right-click the list and select the appropriate menu.
If the program fails to locate files Windows links to from within the AMCache database, it marks the files with red color.