Password Recovery Software

Reset Windows Password: view program execution timeline

It would not be a big surprise to know that there are a lot of artifacts that contain information about recently opened documents or launched files in Windows. The AMCache is one of them, which stores data about every program that has been started or installed in the system earlier. The AMCache is available starting with Windows 7. Older operating systems use a BCF format to save data about executed programs. Physically, both formats are simple files located in the '%WINDIR%\appcompat\Programs' folder. The AMCache.hve is a registry hive that provides a timeline of which program was executed and when, while the RecentFileCache.bcf stands for a simple Binary Cache File.

The program supports both formats, however, the old BCF format contains no information about the execution time.

 

Choosing Windows directory

Select the Windows directory detected by the program.


 

View program execution timeline

Now it's time to hit the << SEARCH FILES >> button and wait for the program to locate the files to fill in the table.