Prefetch Files on Windows 11: Proving a Program Ran, and When

What Prefetch Actually Is

Prefetch exists for performance, not for you. When a program starts, Windows records which files and libraries it touched in its first ten seconds, so the next launch can load them ahead of time. The side effect is a durable, per-executable record of execution that survives the program's deletion.

Each record is a file in C:\Windows\Prefetch named <EXECUTABLE>-<HASH>.pf, where the hash is derived from the full path the binary ran from. That detail matters: the same executable run from two different folders produces two different .pf files. A SVCHOST.EXE prefetch file whose hash does not match the one for C:\Windows\System32\ is worth a long look.

What It Proves

A .pf file gives you:

• Run count — how many times this binary has executed from this path.
• The last eight execution timestamps. Windows 8 onward keeps eight; older references saying "the last run time" are describing Windows 7.
• First execution time — approximately the creation time of the .pf file itself.
• Referenced files and directories — up to a few hundred paths the program loaded, which frequently includes the volume it ran from, config files, and the user profile it touched.

That last list is underrated. A .pf file for a deleted binary still names the DLLs it pulled in and often the directory it was launched from — sometimes a USB volume that is no longer attached.

Before You Start: Confirm Prefetch Is Enabled

An empty Prefetch folder does not prove nothing ran. Check the setting first:

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher

Values: 0 disabled, 1 application prefetch only, 2 boot prefetch only, 3 both. On a normal Windows 11 desktop install you expect 3. A 0 on a machine that was not deliberately tuned is itself a finding — some "optimiser" utilities and some malware disable it.

Step 1: Copy the folder out, do not work in place

Prefetch is a live directory that Windows writes to constantly. Every minute you spend browsing it, the machine may be rolling off older entries — the folder caps at 1024 files.

From an elevated prompt:

robocopy C:\Windows\Prefetch C:\cases\prefetch-copy /E

If the file is locked, image the volume or use a forensic copy tool. Do not fight the lock on a live system you care about.

Step 2: Parse the whole folder at once

PECmd handles the directory in one pass and writes a CSV:

PECmd.exe -d C:\cases\prefetch-copy --csv C:\cases\out --csvf prefetch.csv

Open prefetch.csv in Timeline Explorer. The columns that matter immediately: ExecutableName, RunCount, LastRun, PreviousRun0 through PreviousRun6, and Directories.

Step 3: Sort by last run, then read the run count

Sort descending on LastRun. This is your execution timeline for the machine, newest first.

Then read RunCount against it. The pattern that draws attention is a high run count on a binary you do not recognise, or the inverse — a run count of 1 on something with a system-sounding name. Legitimate Windows components have run counts in the hundreds on a machine that has been up for months.

Step 4: Check where each binary ran from

Expand the Directories and FilesLoaded columns for anything suspicious. You are looking for executables that ran from:

• C:\Users\<user>\AppData\Local\Temp\
• C:\Users\<user>\Downloads\
• C:\ProgramData\ at the root
• A removable volume — the path will name a drive letter that is not C:

None of those are proof of anything on their own. Together with a low run count and a recent timestamp, they are where you start looking.

Step 5: Cross-check against a second artifact

Prefetch alone is a data point. Before you write anything down, confirm it against BAM (which user ran it) or SRUM (whether it moved data). The artifact overview covers which second source answers which question.

The Three Ways This Misleads You

The 1024-file cap. On a busy workstation, Prefetch covers weeks, not months. Absence of a .pf file for something you expect proves nothing if 1024 entries only reach back to last month. Check the oldest .pf creation date to establish your window.

Run count includes crashed launches. A program that started and immediately died still increments the count. High run count on a broken binary can mean something was retrying, not that it worked.

Renamed binaries produce honest but useless names. .pf files record the executable name at run time. Malware that copied itself to chrome.exe produces a CHROME.EXE-<hash>.pf whose hash will not match the real Chrome's. Compare hashes across .pf files with the same executable name — two different hashes for one name means two different paths.

Related

• Amcache.hve — gives you the SHA-1 of a binary Prefetch only names
• Windows 11 forensic artifacts overview
• Consumer guide: removing malware from Windows 11

FAQ

Is Prefetch disabled on SSDs?

Not by default on Windows 11. That belief comes from Windows 7-era guidance and from Superfetch/SysMain behaviour, which is a different subsystem. Windows 11 leaves EnablePrefetcher at 3 on standard desktop installs. Always check the registry value rather than assuming either way — and note that Windows Server defaults differ.

How far back does Prefetch go?

Until the folder hits 1024 files, then the oldest entries are removed. On a lightly used machine that can be years; on a developer workstation running hundreds of distinct binaries, weeks. Check the creation timestamp of the oldest .pf file to establish your actual window before drawing conclusions from absence.

Can Prefetch prove who ran a program?

No. Prefetch is machine-wide and holds no user context. Use BAM (HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>) for last-execution-per-user, or UserAssist for GUI launches by a specific profile.

Does clearing Prefetch hide activity?

It removes the records, but the deletion is itself visible: an empty or sparsely populated Prefetch folder on a machine with significant uptime is anomalous, and the folder's own metadata plus $UsnJrnl entries for the deletions often survive. Wiping evidence tends to be louder than leaving it.