Prefetch files

Prefetch files are located under C:\Window\Prefetch and are used to increase system performance by preloading code pages of commonly used applications.

These files have a .pf extension and contain program execution timestamps and the number of runs, as well as a referenced folders and files list.

Prefetch files can be parsed with PECmd:

Figure 7.10 – A part of PECmd output

Of course, prefetch files are not the only source of evidence of execution and more will be discussed in the Windows Registry and Windows event logs sections.

Now let's look at some artifacts of file access – LNK files and jump lists.