Blog
Practitioner write-ups on Windows Prefetch: formats, hashes, anti-forensics and how to read execution evidence.
2026-05-28
Windows Prefetch parsing tools compared — PECmd, WinPrefetchView, and browser-based parsers
PECmd, WinPrefetchView, libscca, and online parsers — what each one is good at, what it misses, and when to reach for which.
Read more →2026-05-27
Prefetch anti-forensics: what attackers can hide, what they can't
EnablePrefetcher=0, deleting .pf files, the rename-before-run trick. A practitioner's view of which attacks against Prefetch work and which leave a trail you can follow.
Read more →2026-05-27
Prefetch as evidence: what .pf files actually prove
The Windows Prefetch is the most reliable proof-of-execution artifact you'll see in DFIR — but only if you understand what it doesn't say. A practitioner's view on .pf files.
Read more →2026-05-27
Why Windows Server has no prefetch files — PrefetchParameters and SysMain explained
Prefetch is off by default on Windows Server, controlled by registry, and tied to the SysMain service. Here is what governs it and how to verify state on a live system.
Read more →2026-05-27
The Windows Prefetch file format across versions
SCCA, MAM compression, sections A through D, and the version field. A practitioner's walkthrough of how .pf files have changed from XP to Win11, and which parsers keep up.
Read more →2026-05-27
The file load list: what every .pf can tell you about what a binary did
The Prefetch load list is the part most analysts skim. It's also where DLL hijacks, malware configs, and document opens hide in plain sight. A practical guide.
Read more →2026-05-27
Did the program actually run? Prefetch and process execution
Prefetch is the strongest single proof-of-execution artifact in Windows DFIR. Here's where the claim is solid, where it breaks, and how to corroborate it with EVTX 4688 and Sysmon.
Read more →2026-05-27
Investigating ransomware with Prefetch: a walkthrough
A fictional but realistic ransomware case rebuilt from Prefetch. The eight timestamps, the encryptor's load list, lateral-movement tools. How the .pf files tell the story.
Read more →2026-05-27
SuperFetch, SysMain, and the Win10/11 Prefetch confusion
SuperFetch became SysMain in Win10 1709. Prefetch is partly disabled on SSDs. Here's what the registry knobs actually do, and what to verify before trusting a .pf file.
Read more →2026-05-26
Detecting Windows Prefetch tampering and anti-forensics
Attackers delete, plant, and falsify .pf files to obscure execution evidence. Here is how to spot the common signs and what each one tells you.
Read more →2026-05-25
How to analyze Windows Prefetch files — a forensic walkthrough
A practical step-by-step guide to reading .pf files for execution evidence — what to look for, what to ignore, and how to corroborate findings.
Read more →2026-05-24
Prefetch vs Amcache vs ShimCache — picking the right execution artifact
Three Windows artifacts record program execution. They overlap, but each one captures something the other two miss. Here is when to reach for which.
Read more →2026-05-23
What changed in Windows Prefetch v30 and v31 (Windows 10 and 11)
The SCCA version field is the single most useful number in a prefetch file. Here is what each version means and what to watch for when parsing v30 (Win10) and v31 (Win11).
Read more →2026-05-22
Inside MAM compression — how Windows 8+ packs prefetch files
Modern .pf files start with a MAM signature and an Xpress Huffman compressed payload. Here is how the framing works, why it was introduced, and what a parser has to do to read it.
Read more →2026-05-21
How the Windows Prefetch hash is calculated
The 8-character suffix in every .pf filename is a path-derived hash, and the algorithm has changed three times. Here is what it computes and why it matters for forensics.
Read more →2026-05-20
Understanding Windows Prefetch for forensics
What .pf files record, why they matter, and how this parser reads them entirely in your browser.
Read more →