New Windows 11 Pro (22H2) Evidence of Execution Artifact!
By: Andrew Rathbun and Lucas Gonzalez Background In the last week of December 2022, on the Digital Forensics Discord Server, some discussion was brought up by a member in the #computer-forensics channel asking if anyone knew a Windows 11 folder path of interest, linked here. The location in question is C:\Windows\appcompat\pca. This may look like a familiar folder path, as the Amcache resides in C:\Windows\appcompat\Programs\Amcache.hve. What is PCA? PCA stands for Program Compatibility Assistant, which…