Prefetch

Windows writes a .pf file the first time a program runs and updates it on subsequent runs. It is the most direct execution evidence on a workstation, and one of the few artifacts that records how many times something ran.

windows · Execution · T1204

where it lives

C:\Windows\Prefetch\<NAME>-<HASH>.pf

Windows XP through 11

The hash is of the full path, so the same binary run from two locations produces two files.

what it proves

  • The program executed on this host
  • The last eight execution times (Windows 8 and later; one on Windows 7 and earlier)
  • A total run count
  • Files and directories the process touched in its first ten seconds, which often names the payload it loaded

what it does not prove

  • WHO ran it — Prefetch carries no user context at all
  • That the binary is still on disk; the .pf outlives the file it describes, which is exactly why it matters after a wipe
  • Anything on most servers, where prefetching is disabled by default
  • A complete history — the store is capped at 1024 entries on Windows 8+ and 128 on XP, so a busy host rolls the oldest out

parsing it

  • PECmd (Eric Zimmerman)
  • WinPrefetchView
  • prefetch-parser (python)

tampering and anti-forensics

Deleting the folder is noisy and leaves the deletion itself in the USN journal. An attacker can disable prefetching via EnablePrefetcher, which stops new files but does not remove existing ones — and the registry change is itself an indicator.

how long it survives

Until rolled out by the 1024-entry cap. On a normal workstation this is months.

read next

shimcache · amcache · userassist

Corrections are welcome and this is a working document, if your estate behaves differently, that is a finding worth having. Say so in the community.