analyzing-prefetch-files-for-execution-history - Analyze Windows Prefetch files for execution history
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
Tags
Updated: 2026-09-24Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Extract Prefetch files from image
- Parse Prefetch files using PECmd
- Parse Prefetch files using Python
- Identify suspicious execution evidence
- Build application execution timeline
Inputs
- Windows Prefetch files
- Forensic image
Outputs
- Parsed Prefetch CSV and JSON reports
- Execution timeline CSV file
- File integrity hash file
Requirements
- Access to Windows Prefetch files
- PECmd tool
- Python 3 environment