Home > Products > Windows Passwords > Reset Windows Password > Screenshots > Program execution timeline
View program execution timeline
10.03.2021
Reset Windows Password v10.1
Some minor improvements and bug fixes
10.02.2021
Reset Windows Password v10.0
The program can search and recover passwords for encrypted documents now
05.02.2021
Wireless Password Recovery v6.3.4
Some bugs and error correction
25.12.2020
Happy Holidays!
Merry Christmas and Happy New Year

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Reset Windows Password: view program execution timeline


It would not be a big surprise to know that there are a lot of artifacts that contain information about recently opened documents or launched files in Windows. The AMCache is one of them which stores data about every program that has been started or installed in the system earlier. The AMCache is available starting with Windows 7. Older operating systems use a BCF format to save data about executed programs. Physically, both formats are simple files located in the '%WINDIR%\appcompat\Programs' folder. The AMCache.hve is a registry hive that provides a timeline of which program was executed and when, while the RecentFileCache.bcf stands for a simple Binary Cache File.

The program supports both formats, however, the old BCF format contains no information about the execution time.

 

Choosing Windows directory

Program execution timeline - choosing Windows directory

Select the Windows directory detected by the program.


 

View program execution timeline

View program execution timeline

Now it's time to hit the << SEARCH FILES >> button and wait for the program to locate the files to fill in the table.

In order to wipe out any unnecessary file from the list of found items, right-click the list and select the appropriate menu.
 
If the program fails to locate files Windows links to from within the AMCache database, it marks the files with red color.