Prefetch
Windows writes a .pf file the first time a program runs and updates it on subsequent runs. It is the most direct execution evidence on a workstation, and one of the few artifacts that records how many times something ran.
where it lives
C:\Windows\Prefetch\<NAME>-<HASH>.pfThe hash is of the full path, so the same binary run from two locations produces two files.
what it proves
- The program executed on this host
- The last eight execution times (Windows 8 and later; one on Windows 7 and earlier)
- A total run count
- Files and directories the process touched in its first ten seconds, which often names the payload it loaded
what it does not prove
- WHO ran it — Prefetch carries no user context at all
- That the binary is still on disk; the .pf outlives the file it describes, which is exactly why it matters after a wipe
- Anything on most servers, where prefetching is disabled by default
- A complete history — the store is capped at 1024 entries on Windows 8+ and 128 on XP, so a busy host rolls the oldest out
parsing it
PECmd (Eric Zimmerman)WinPrefetchViewprefetch-parser (python)
tampering and anti-forensics
Deleting the folder is noisy and leaves the deletion itself in the USN journal. An attacker can disable prefetching via EnablePrefetcher, which stops new files but does not remove existing ones — and the registry change is itself an indicator.
how long it survives
Until rolled out by the 1024-entry cap. On a normal workstation this is months.