%windir%\Prefetch\SYSTEM\ControlSet###\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher
Operating System
Artifact Category
  • Applications
  • System
Prefetch files, like any other file in a file system, can be viewed from a digital forensic perspective to further a forensic investigation. Using appropriate tools and techniques available to a digital forensic examiner, we explore and investigate the potential of prefetch files and what they have to offer from a digital forensic analysis perspective in an effort to contribute towards the rapidly advancing field of digital forensics. Windows' prefetch files are used to decrease the startup times of applications and are formatted in a manner to instruct application processes to load data and necessary libraries into memory that it needs before it is actually demanded. In other words, prefetch files help avoid a hard fault, thereby minimizing startup times. These files reside in the prefetch folder under the Windows installation directory of a system. This folder contains prefetch files for user and system applications as well as a ReadyBoot folder, a layout.ini file, and several database files. In this paper, we investigate the mechanism behind the creation and manipulation of prefetch files on a Windows machine. Diving deep into the assembly code generated by the disassembler IDA PRO from ntkrnlpa.exe, we are able to find the Windows kernel processes responsible for the creation of these prefetch files and parse these prefetch files to better understand their forensic value. -Narasimha Shashidhar, Dylan Novak -

User comments

There are no user comments for this listing.
Already have an account? or Create an account