domains / families / security / analyzing-prefetch-files-for-execution-history

analyzing-prefetch-files-for-execution-history

separate

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.

When to use

• When determining which programs were executed on a Windows system and when
• During malware investigations to confirm execution of suspicious binaries
• For establishing a timeline of application usage during an incident
• When correlating program execution with other forensic artifacts
• To identify anti-forensic tools or unauthorized software that was run

Skill page

Source