analyzing-prefetch-files-for-execution-history

name	analyzing-prefetch-files-for-execution-history
description	Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation. Use when working with analyzing prefetch files for execution history.
domain	cybersecurity
tags	["forensics","prefetch","windows-artifacts","execution-history","timeline-analysis","evidence-collection"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Prefetch Files For Execution History

Overview

Cybersecurity skill for analyzing prefetch files for execution history. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing prefetch files for execution history"

• "Parse Windows Prefetch files to determine program execution history including ru"

• When determining which programs were executed on a Windows system and when

• During malware investigations to confirm execution of suspicious binaries

• For establishing a timeline of application usage during an incident

• When correlating program execution with other forensic artifacts

• To identify anti-forensic tools or unauthorized software that was run

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Access to Windows Prefetch directory (C:\Windows\Prefetch) from forensic image
• PECmd (Eric Zimmerman), WinPrefetchView, or python-prefetch parser
• Understanding of Prefetch file format (versions 17, 23, 26, 30)
• Windows system with Prefetch enabled (default on client OS, disabled on servers)
• Knowledge of Prefetch naming conventions (APPNAME-HASH.pf)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}