Research

Mini-guide: what a Prefetch file proves, and the three things it cannot tell you

Prefetch is the best execution evidence most Windows workstations keep by default. What is inside a .pf file, how to read the eight run times, why two files for one program can be normal or a finding, and where it runs out.