por Windows Prefetch is a performance optimization feature in Windows operating systems that was first introduced in Windows XP. The goal of Windows Prefetch is to improve the loading time of programs and applications by predicting which files and data will be needed most frequently and caching them on your hard drive for faster access.
Now we will see a little more in depth how to view this tool and what uses it has.
Some generalities
The mission of Windows Prefetch is to increase system performance by preloading the executable.
The cache manager monitors all files and directories and maps them against the file .pf (the .pf file will be the forensic artifact that we will analyze).
Windows Prefetch is disabled by default on systems with SSD drives, since these solid state drives are extremely useful for improving the startup performance of the operating system, among other things. Therefore, unnecessary information would be overwritten. Shows how and when a binary was executed. That is, every time we run a program, a Windows Prefetch file is saved, with the .pf extension, and it returns information about the time it was run, when it was run, and so on.
We can find the Prefetches in the following path: C: \Windows \Prefetch
It is limited to 128 files in Windows XP, Win Vista and Win 7. It is limited to 1024 files in Win 8 and Win 10. It is named like this: {Executable_name} – {hash}.pf
The hash is based on the path of the executable and the arguments it receives.
How does Windows Prefetch work?
When you run a program or application on a Windows operating system, the operating system uses the corresponding Prefetch file to load the necessary data, thereby running the program more efficiently. The Prefetch file contains information about the files needed by the program, as well as how to access them. When using Windows Prefetch, the operating system can load necessary files into the cache before they are requested, reducing program loading time and improving overall system performance.
Analyze Windows Prefetch files
If we want to view the Windows Prefetch folder, we have to first mount a disk image. In this case we will use FTK Imager. Let’s see:
To analyze the Windwos Prefetch files, we go to the Prefetch folder, right-click and, in the menu that appears, select the option that says «Export files.»
Next, we are going to select the location where we will save the files and click to accept. We wait for them to download:
Once all the files in the folder have been exported, we are going to go to the place where we have exported them:
And we see that we have access to all of these .pf files.
If we try to view these files without any program, just with Notepad, they will be practically unreadable for us. Fortunately, Erick Zimmerman has a tool, called PECmd, with which we can open these types of files.
PECmd
To analyze the files inside the Windows Prefetch folder, we can use this tool. The first thing we will do is download it and, later, we go to the command prompt and access the folder where we have the executable.
Once there, we are going to enter the name of the executable, followed by the .exe extension (executable extension) and the -h command:
Then we will pass it the directory. We will tell you to save it as CSV in the directory that we indicate:
Now all we have to do is wait for it to run.
Once executed, we can review the files that have been exported and saved from the command prompt, thanks to the Timeline Explorer:
What we would see with this tool would be something similar to this, which it understands much better than the files we had before and which were in unintelligible characters:
How to continue learning about cybersecurity?
We have already seen what Windows Prefetch is, what it is for, where to find these files and what we can do with the files contained in said folder. If you want to continue training in the different disciplines that computer security coversTake a look at our Full Stack Cybersecurity Bootcamp, the training with which you will become a great IT professional in a short time. Enter to request more information and transform your professional future right now!