Prefetch Forensics Cheat Sheet

What it is

Prefetch is a performance feature managed by the SysMain service (formerly Superfetch). When an application starts, Windows monitors the files it loads during roughly its first ten seconds and saves that list, together with run metadata, into a .pf file so the next launch is faster. For investigators each .pf file is one of the strongest pieces of evidence of execution on a workstation.

Location

Windows version	Path	Format version
XP / Server 2003	`C:\Windows\Prefetch\*.pf`	17
Vista / 7	`C:\Windows\Prefetch\*.pf`	23
8 / 8.1	`C:\Windows\Prefetch\*.pf`	26
10 / 11	`C:\Windows\Prefetch\*.pf` (compressed, `MAM` signature)	30 (some Windows 11 builds: 31)

File name: <EXECUTABLE NAME>-<8 hex digit hash>.pf, for example CMD.EXE-0BD30981.pf. The hash is computed from the executable's full device path, so the same binary launched from two folders produces two .pf files. For "hosting" binaries (svchost.exe, dllhost.exe, rundll32.exe, mmc.exe) the command line is also hashed, which is why several .pf files exist for them.

The same folder also holds Layout.ini and the SysMain Ag*.db databases, which are separate artifacts.

What it proves

Execution: the named executable was launched at least once from the path encoded in the file.
How often and when: run count plus the most recent run time (Vista/7) or up to eight run times (8 and later).
What it touched: DLLs, configuration files and documents opened in the first seconds of execution, with full volume paths. A document path listed in the Prefetch of WINWORD.EXE or 7Z.EXE shows that file was involved.
Which volume: volume device path, creation time and serial number, useful for tying execution to a removable drive.

Key fields

Field	Meaning
Executable name	Upper-case name, truncated to 29 characters in the header
Hash	Path hash in the file name; different hash = different launch path or command line
Run count	Number of launches recorded by SysMain
Last run time(s)	1 timestamp (XP–7) or up to 8 (8+), newest first
Volume information	Device path, serial number, creation time of each referenced volume
Files referenced	Full paths of files loaded during start-up
Directories referenced	Folders touched during start-up (Vista+)

Timestamps

Timestamp	Set when	Format	Pitfalls
Last run time(s) (embedded)	SysMain writes the `.pf` after the start-up monitoring window	FILETIME, UTC	Typically lands ~10 seconds after the actual process start; do not treat it as the exact launch second
`.pf` file creation time ($SI)	First time the executable was prefetched	NTFS, UTC	Resets if the `.pf` was deleted and recreated, or evicted and recreated later
`.pf` file modification time ($SI)	Last update of the `.pf`	NTFS, UTC	Usually matches the latest embedded run time
Volume creation time	Volume formatting	FILETIME, UTC	Describes the volume, not the execution

Retention and clearing

The folder is capped: 128 entries on XP–7 and 1,024 entries on Windows 8 and later. Older files are evicted when the limit is reached, so a missing .pf does not prove the program never ran.
Only the most recent eight run times are kept; older runs are only reflected in the run count.
Prefetching is controlled by EnablePrefetcher under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters (0 disabled, 1 applications, 2 boot, 3 both). It is disabled by default on Windows Server.
Attackers and cleanup tools delete .pf files. Deletions are often visible in the USN journal and the $MFT.

Collection

KAPE target: Prefetch
Velociraptor (Windows.Triage.Targets): Prefetch
Built-in: the files are not locked, so a plain copy works. Use robocopy to keep the original timestamps:

robocopy C:\Windows\Prefetch E:\case\Prefetch *.pf /COPY:DAT /DCOPY:T
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher

Parsing tools

PECmd (Eric Zimmerman, free): PECmd.exe -d E:\case\Prefetch --csv E:\out produces a per-file CSV and a timeline CSV of every run time. It decompresses Windows 10/11 files when run on Windows 8 or later.
WinPrefetchView (NirSoft, free): quick GUI review.
libscca / pyscca (Joachim Metz, open source): library and sccainfo tool, with format documentation.
Velociraptor: the Windows.Forensics.Prefetch artifact parses Prefetch on live endpoints.
Plaso: the prefetch parser adds every run time to a super timeline.

Investigation tips

Hunt for executables in user-writable locations (\Users\Public\, \AppData\Local\Temp\, \ProgramData\) and for classic attacker tools (PSEXESVC.EXE, RCLONE.EXE, MIMIKATZ.EXE, renamed PROCDUMP).
Several hashes for the same name point to multiple launch locations: compare the file paths in each .pf to find the unusual one.
Read the referenced-file list: a script host (WSCRIPT.EXE, MSHTA.EXE) Prefetch that references a file in Downloads often reveals the initial payload.
Correlate with Amcache (SHA-1 of the binary), ShimCache and BAM (per-user attribution, which Prefetch lacks).
On a system where Prefetch is empty or recent files are missing, check EnablePrefetcher before concluding anti-forensics.

Prefetch Files (.pf)

Tools