Skip main navigation

Prefetch Files

Article detailing the basics Prefetch files.
© PA Knowledge Ltd | 7Safe Training

Prefetch Files

When system or user programs are executed on a Windows computer a Prefetch file is created. The purpose of the Prefetch file is to increase the performance of the computer by pre-loading code pages. Example of prefetch files are detailed below:

Example of Prefetch files contained within a Prefetch folder.

A Prefetch file is created for every program executed. Note a program does not have to installed, execution of standalone programs will also result in the creation of Prefetch files. A Prefetch file name contains the original name of the executable file followed by a hexadecimal value of the path that executable file resides in together with a ‘.pf’ file extension.

It can seen in the above image that many programs have been executed. Note that highlighted Prefetch files indicating that the BitLocker Wizard and a Command Prompt has been executed.

The Prefetch files record the first and last times an executable has been run, the name and the path it was executed from, how many times it has been executed together with the dates and times for the last 8 executions.

An example of Prefetch metadata is detailed below:

Screenshot of WinPrefetchView displaying Prefetch file metadata.

It can be seen that whilst the BitLocker Wizard has only been executed once, the Command Prompt has been executed on 94 occasions!

Malware has to execute to have an effect on a computer. It must run as a process in its own right or run as part of another process. If the malware has run as a process in its own right a Prefetch file will be created for that process.

Analysis of Prefetch files should therefore form part of any malware investigation.

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education