Prefetch

Location & availability

C:\Windows\Prefetch\*.pf

Coverage depends on Windows edition, configuration and retention. Use a parser supporting the collected format.

Fields to examine

• Executable name and Prefetch identifier; the identifier is not a content hash.
• Internal run timestamps and run count where the format supplies them.
• Referenced files and volume information; referenced files are not automatically executed modules.

What it can establish

• Support execution of an associated executable within the retained history.
• Connect a startup record to a volume and path context.

What it cannot prove

• Identify the human operator or prove cheating.
• Prove that execution never happened because a .pf file is missing.

Use it in a screenshare

1. Record the disputed session, timezone and Windows build. Preserve the relevant .pf files before launching investigation tools.
2. Parse a copy with PECmd. Inspect internal timestamps instead of treating the .pf file modification time as the complete run history.
3. Match path context and time against BAM, a process event, or the actual game logs. Check whether a similarly named legitimate tool explains the record.

Worked example

A launcher-like executable has a Prefetch run timestamp during the session. Report that supported execution observation. Its filename alone does not identify its contents; obtain a matching file hash or another identity-bearing source before attributing it to a particular client.

Cross-check the finding

• BAM →Support recent executable activity associated with a Windows user SID.
• Security event 4688 →Support process creation recorded by the audited host.
• Amcache →Show that Windows inventoried a file or application identity.

Sources

• PECmd — parser documentation ↗