Comparative Analysis of Amcache Trace Formation Mechanisms in Windows 10 and Windows 11

This article examines the mechanism of trace formation of the Amcache system registry file in Windows 11. Information about this file from open sources on the Internet is considered. The study of this registry file is carried out using a special utility. The comparison takes place in stages, actions are sequentially carried out with the software in the system and changes are observed for each step. Next, an experimental comparison of the trace formation mechanisms in the Amcache system registry file for Windows 10 and Windows 11 is carried out. As part of the study, the same software is first installed on both systems. Then it tries to run the software with different parameters on both systems. After the selected software is removed from both operating systems. At each step, the results for each OS are recorded and the results are compared. In the last part of the article, the obtained data is summarized and analyzed. The results of the conducted study are summed up.