> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/pca.md).

# PCA

Tracks GUI execution, not user based.

### File Location

* C:\Windows\appcompat\pca

{% embed url="<https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/>" %}

### Parsing Data

No need to parse data, comes in formated text file.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FnaNgo6hVa1um7HhtwiJ8%2Fimage.png?alt=media&amp;token=3e1081cf-d12b-4703-992e-b9dca4b8a768" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FYFXTKTYRByGEjxBAiUaZ%2Fimage.png?alt=media&amp;token=ff681219-9249-4378-b7e5-59eca9214855" alt=""><figcaption></figcaption></figure>

### Considerations

* New Windows 11 execution artifact.
* Tracks GUI execution.
* Tracks full binary path and last executed time in UTC PcaAppLaunchDic.txt.
* Usually PcaGeneralDb1.txt won't have data.

**PcaGeneralDb0.txt**

Ties in with amcache and contains FileID. Can be used to correlate execution and file existence.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FwZNBBXEO4M9abl4NGZvX%2Fimage.png?alt=media&amp;token=e9d9be01-8362-4bb8-bb03-c2d648fcc235" alt=""><figcaption></figcaption></figure>

### Anti Forensics