Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Program execution timeline
View program execution timeline
Reset Windows Password v11.4
Windows activity timeline, Windows clipboard history, etc.
Windows Password Recovery v14.3
Preliminary support for Windows 11
Outlook Password Recovery v3.2.1
Support for Windows 11 and the latest version of MS Outlook
Reset Windows Password v11.3
New forensic utilities, support for Windows 11 and Windows Server 2022

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: view program execution timeline

It would not be a big surprise to know that there are a lot of artifacts that contain information about recently opened documents or launched files in Windows. The AMCache is one of them, which stores data about every program that has been started or installed in the system earlier. The AMCache is available starting with Windows 7. Older operating systems use a BCF format to save data about executed programs. Physically, both formats are simple files located in the '%WINDIR%\appcompat\Programs' folder. The AMCache.hve is a registry hive that provides a timeline of which program was executed and when, while the RecentFileCache.bcf stands for a simple Binary Cache File.

The program supports both formats, however, the old BCF format contains no information about the execution time.


Choosing Windows directory

Program execution timeline - choosing Windows directory

Select the Windows directory detected by the program.


View program execution timeline

View program execution timeline

Now it's time to hit the << SEARCH FILES >> button and wait for the program to locate the files to fill in the table.

In order to wipe out any unnecessary file from the list of found items, right-click the list and select the appropriate menu.
If the program fails to locate files Windows links to from within the AMCache database, it marks the files with red color.