Prefetch
Definition
A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf files prove an executable ran.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.
Explained in
- Windows Forensic Artifacts I: Registry, Event Logs and PrefetchA Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf files prove an executab...