Skip to content
RecentFileCache

RecentFileCache.bcf parser, in your browser.

Drop a Windows 7 RecentFileCache.bcf file and inspect its cached file paths. Parsing runs locally in WebAssembly — your evidence never leaves your machine.

RecentFileCache parser

Parse a Windows RecentFileCache.bcf file entirely in your browser.

Open — RecentFileCache.bcf

Drop a RecentFileCache.bcf file here, or click to choose one.

Parsing runs 100% client-side via WebAssembly. The file is never uploaded.

Waiting for a file…

Blog

Read the blog
The Application Experience appraisal task: when the BCF gets written, and when it gets cleared
The BCF's lifecycle is one scheduled task. Understand when ProgramDataUpdater runs, when it clears the file, and how to spot a disabled appraiser.
recentfilecachescheduled-tasksdfirwindows-forensics
The RecentFileCache.bcf file format, in plain terms
The BCF format is a header, a list of length-prefixed UTF-16LE paths, and that's it. Here is what every byte means and why nothing has changed since 2009.
recentfilecachefile-formatdfirwindows-forensics
Investigating a Win7 host with the BCF: a short walkthrough
A SOC-flagged Win7 endpoint, 14 paths in the BCF, three worth a second look. A realistic corroboration chain and how much the BCF actually contributed.
recentfilecachedfircase-studywindows-forensics