windows-prefetch-analysis

Windows Prefetch Analysis

When to Use

• When investigating a compromised Windows system to answer the question: "Did the attacker actually run this tool/malware?"
• To build a timeline of threat actor activities by examining execution timestamps and accessed files.
• When an attacker has deleted their malware, but the prefetch file remains as evidence.

Prerequisites

• Forensic image or live access to the affected system(s)
• Forensic workstation with analysis tools (Autopsy, Volatility, Timeline Explorer)
• Chain of custody documentation initiated for evidence handling
• Write-blocker for disk forensics or memory acquisition tool (e.g., DumpIt, WinPmem)

Workflow

Phase 1: Locating and Understanding Prefetch Files

Prefetch files are typically located at C:\Windows\Prefetch. They are named ending with .pf (e.g., CMD.EXE-4A81B364.pf).

Note: Prefetch is enabled by default on Windows Client OS architectures but may be disabled on Windows Servers.

Phase 2: Offline Analysis with PECmd (Eric Zimmerman's Tools)

# Concept: Parse a single prefetch file PECmd.exe -f "C:\Windows\Prefetch\MIMIKATZ.EXE-53D22409.pf"

# PECmd.exe -d "C:\Windows\Prefetch\" -q --csv "C:\Forensics\Output" --csvf "prefetch_timeline.csv"

Phase 3: Interpreting the Output

When examining the parsed output, focus on:

• Run Count: How many times was the binary executed?
• Execution Times: Up to 8 previous execution timestamps (depending on OS version). Last execution time is crucial for timeline building.
• Files/Directories Accessed: The directories and files the program loaded (e.g., DLLs, configuration files, text files the attacker interacted with).

Phase 4: Basic Live System Check (Powershell)

# Get-ChildItem -Path "C:\Windows\Prefetch" | Where-Object { $_.Name -match "MIMIKATZ|PSEXEC|NC.EXE" } | Select-Object Name, LastWriteTime

Decision Point 🔀

flowchart TD
    A[Locate Prefetch Folder ] --> B{Prefetch Enabled? ]}
    B -->|Yes| C[Extract .pf Files ]
    B -->|No| D[Check ShimCache/Amcache ]
    C --> E[Parse with PECmd ]