Prefetch
Definition
A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf files prove an executable ran.
- Platform
- Windows
- File extension
- .pf
- Records
- Executable launches and files touched in first 10 seconds
- Forensic value
- Proves an executable ran
Common questions
What does a Prefetch file NOT prove about execution?+
A .pf file proves that an executable ran at least once at some point in its recorded run-count history, but by itself it does not prove who launched it or what the executable actually did once running, so it must be correlated with other artefacts such as event logs or timeline data.
How does Prefetch data help build an execution timeline?+
Each .pf file stores a last-run timestamp and a run count, and when correlated across multiple prefetch files an examiner can reconstruct a sequence of programs launched around a time of interest, which is useful for establishing that malware or a specific tool executed on the system.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.