Skip to content

Back to the catalog

Digital Forensics: Analyzing Windows Prefetch Files for Evidence
hackers-arise.comarticle

Digital Forensics: Analyzing Windows Prefetch Files for Evidence

Windows Prefetch forensics tutorial from Hackers Arise. It explains that prefetch files in C:\Windows\Prefetch record last run time, run count and files touched, so they prove an application was used even after deletion. It shows parsing with NirSoft WinPrefetchView, building a timeline from Last Run Time, and how a suspect could disable Prefetch or Superfetch (SysMain).

TL;DR Shows how to read and parse Windows Prefetch files with WinPrefetchView to prove program execution and build timelines.
Open original ↗

Organisations named here

  • anti-forensics
  • Prefetch
  • Superfetch
  • SysMain

Technologies named here

  • Windows 10
  • Windows
  • Autopsy (application used as the example program in the WinPrefetchView screenshot)
  • Computer Management, Services (used to stop or disable Superfetch/SysMain)
  • EnCase (forensic suite able to parse prefetch)
  • FTK (forensic suite able to parse prefetch)
  • Oxygen (forensic suite able to parse prefetch)
  • Windows Server 2003, 2008 and 2012 (application prefetch has to be turned on in the registry)
  • Windows Vista and later (Superfetch, called SysMain on Windows 10/11)
  • WinPrefetchView (Nirsoft, free GUI tool that parses Windows prefetch files; upper pane shows executable path, run count and last run time, lower pane lists files the program used)

Techniques named here

  • Anti-forensics: disabling Prefetch or stopping Superfetch (SysMain on Windows 10/11) through Computer Management, Services
  • Windows Prefetch analysis: .pf files in C:\Windows\Prefetch hold the last run time, file locations, run count and files touched, and show an application was used even after its executable was deleted

Also named here

  • WinPrefetchView
  • Autopsy

Related in Blue Team & Detection