> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/prefetch.md).

# Prefetch

Tracks execution of apps

{% embed url="<https://www.hackingarticles.in/forensic-investigation-prefetch-file/>" %}

{% embed url="<https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/prefetch>" %}

### Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ⚠️      |
| Windows 10    | ✅       | Server 2016   | ⚠️      |
| Windows 8     | ✅       | Server 2012   | ⚠️      |
| Windows 7     | ✅       | Server 2008   | ⚠️      |
| Windows Vista | ✅       | Server 2003   | ⚠️      |
| Windows XP    | ✅       |               |         |

{% hint style="warning" %}
Windows Server systems do not have Prefetch enabled by default.
{% endhint %}

### File Location:

* C:\Windows\Prefetch

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FSJc84Wd4N8GE2JmiI084%2Fimage.png?alt=media&amp;token=4e3b0342-43fb-4bd4-9a3c-4dc6c1059214" alt=""><figcaption><p>Example of Prefetch filesb</p></figcaption></figure>

### Parsing Data

Single file parsing and directory.

```
PECmd.exe -d C:\Windows\prefetch 
PECmd.exe -f C:\Windows\pretfetch\filename.pf
```

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F6L9qQTP9iIkGL5IAKWqO%2Fimage.png?alt=media&amp;token=ec13218e-c3e5-4c19-a078-ce74c04f5e68" alt=""><figcaption><p>Parsed Data</p></figcaption></figure>

### Timeline Parsing

Parse entire prefetch and output a timeline. Will record the execution times of each entry and populate.

```powershell
pecmd -f E:\C\Windows\prefetch -q --csvf baserd01-pretfetch.csv --csv G:\execution
```

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FZVyROhAjjyQKZAEdyxen%2Fimage.png?alt=media&amp;token=2335d429-54d0-4d35-8a92-ef92d61835af" alt=""><figcaption></figcaption></figure>

{% embed url="<https://bromiley.medium.com/tooling-thursday-pecmd-83d1d6d6346b>" %}

### Considerations

* Tracks last 8 times executed (last 7 + initial prefetch file date creation).
* Contains total run times.
* Subtract approximately 10 seconds for initial from MCAB timestamps because it tracks first 10 seconds of execution.
* C:\Windows\Prefetch stores both 64bit and 32bit executable executions.
* Hash at the end of filename specifies file location path and command line.
  * Files that will always have multiple prefetch entries:
    * MMC
    * RunDll
    * Svchost
    * Cmd
    * Dllhost
* Tracks files the .exe interacted with, can discover files compressed in compression related prefetch files.&#x20;

### Anti Forensics

If prefetch files are deleted, they will not be repopulated when applications are run again. Common anti-forensics technique.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FNJfc3qgFBRs0tM9pMzUH%2Fimage.png?alt=media&amp;token=1713e3b8-ccb1-4272-b2c7-273c3dcfeac3" alt=""><figcaption><p>Evidence of prefetch wiping.</p></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FPydREatVoMzY8rcYwIuj%2Fimage.png?alt=media&amp;token=6eac3298-5b93-4de6-975c-b270be1062c8" alt=""><figcaption><p>All prefetch files wiped, may be referenced in the file.</p></figcaption></figure>