# Prefetch Files on Windows 11: Proving a Program Ran, and When URL: https://www.mytechnician.tech/labs/prefetch-files-windows-11-proving-execution/ Published: 2026-08-08 | Author: Ankit Kumar Track: Forensic artifact | Difficulty: Beginner | Authorization: defensive Time required: 25 min Verified on: Windows 11 24H2 (build 26100.2894), Hyper-V VM on an internal-only virtual switch, PECmd 1.5 MITRE ATT&CK: T1057 Tags: Forensics, Execution Artifacts, Filesystem, Windows 11 Summary: A .pf file records how many times a program ran and the last eight times it happened. Here is how to read Prefetch on Windows 11, and the three ways the evidence misleads you. ## What Prefetch Actually Is Prefetch exists for performance, not for you. When a program starts, Windows records which files and libraries it touched in its first ten seconds, so the next launch can load them ahead of time. The side effect is a durable, per-executable record of execution that survives the program's deletion. Each record is a file in `C:\Windows\Prefetch` named `-.pf`, where the hash is derived from the full path the binary ran from. That detail matters: **the same executable run from two different folders produces two different `.pf` files**. A `SVCHOST.EXE` prefetch file whose hash does not match the one for `C:\Windows\System32\` is worth a long look. ## What It Proves A `.pf` file gives you: - **Run count** — how many times this binary has executed from this path. - **The last eight execution timestamps.** Windows 8 onward keeps eight; older references saying "the last run time" are describing Windows 7. - **First execution time** — approximately the creation time of the `.pf` file itself. - **Referenced files and directories** — up to a few hundred paths the program loaded, which frequently includes the volume it ran from, config files, and the user profile it touched. That last list is underrated. A `.pf` file for a deleted binary still names the DLLs it pulled in and often the directory it was launched from — sometimes a USB volume that is no longer attached. ## Before You Start: Confirm Prefetch Is Enabled An empty `Prefetch` folder does not prove nothing ran. Check the setting first: ``` reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher ``` Values: `0` disabled, `1` application prefetch only, `2` boot prefetch only, `3` both. On a normal Windows 11 desktop install you expect `3`. A `0` on a machine that was not deliberately tuned is itself a finding — some "optimiser" utilities and some malware disable it. ### Step 1: Copy the folder out, do not work in place Prefetch is a live directory that Windows writes to constantly. Every minute you spend browsing it, the machine may be rolling off older entries — the folder caps at 1024 files. From an elevated prompt: ``` robocopy C:\Windows\Prefetch C:\cases\prefetch-copy /E ``` If the file is locked, image the volume or use a forensic copy tool. Do not fight the lock on a live system you care about. ### Step 2: Parse the whole folder at once PECmd handles the directory in one pass and writes a CSV: ``` PECmd.exe -d C:\cases\prefetch-copy --csv C:\cases\out --csvf prefetch.csv ``` Open `prefetch.csv` in Timeline Explorer. The columns that matter immediately: `ExecutableName`, `RunCount`, `LastRun`, `PreviousRun0` through `PreviousRun6`, and `Directories`. ### Step 3: Sort by last run, then read the run count Sort descending on `LastRun`. This is your execution timeline for the machine, newest first. Then read `RunCount` against it. The pattern that draws attention is **a high run count on a binary you do not recognise**, or the inverse — a run count of 1 on something with a system-sounding name. Legitimate Windows components have run counts in the hundreds on a machine that has been up for months. ### Step 4: Check where each binary ran from Expand the `Directories` and `FilesLoaded` columns for anything suspicious. You are looking for executables that ran from: - `C:\Users\\AppData\Local\Temp\` - `C:\Users\\Downloads\` - `C:\ProgramData\` at the root - A removable volume — the path will name a drive letter that is not `C:` None of those are proof of anything on their own. Together with a low run count and a recent timestamp, they are where you start looking. ### Step 5: Cross-check against a second artifact Prefetch alone is a data point. Before you write anything down, confirm it against BAM (which user ran it) or SRUM (whether it moved data). The [artifact overview](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/) covers which second source answers which question. ## The Three Ways This Misleads You **The 1024-file cap.** On a busy workstation, Prefetch covers weeks, not months. Absence of a `.pf` file for something you expect proves nothing if 1024 entries only reach back to last month. Check the oldest `.pf` creation date to establish your window. **Run count includes crashed launches.** A program that started and immediately died still increments the count. High run count on a broken binary can mean something was retrying, not that it worked. **Renamed binaries produce honest but useless names.** `.pf` files record the executable name at run time. Malware that copied itself to `chrome.exe` produces a `CHROME.EXE-.pf` whose hash will not match the real Chrome's. Compare hashes across `.pf` files with the same executable name — two different hashes for one name means two different paths. ## Related - [Amcache.hve](https://www.mytechnician.tech/labs/amcache-hve-windows-11-forensics/) — gives you the SHA-1 of a binary Prefetch only names - [Windows 11 forensic artifacts overview](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/) - Consumer guide: [removing malware from Windows 11](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) ## FAQ ### Is Prefetch disabled on SSDs? Not by default on Windows 11. That belief comes from Windows 7-era guidance and from Superfetch/SysMain behaviour, which is a different subsystem. Windows 11 leaves `EnablePrefetcher` at `3` on standard desktop installs. Always check the registry value rather than assuming either way — and note that Windows Server defaults differ. ### How far back does Prefetch go? Until the folder hits 1024 files, then the oldest entries are removed. On a lightly used machine that can be years; on a developer workstation running hundreds of distinct binaries, weeks. Check the creation timestamp of the oldest `.pf` file to establish your actual window before drawing conclusions from absence. ### Can Prefetch prove who ran a program? No. Prefetch is machine-wide and holds no user context. Use BAM (`HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\`) for last-execution-per-user, or UserAssist for GUI launches by a specific profile. ### Does clearing Prefetch hide activity? It removes the records, but the deletion is itself visible: an empty or sparsely populated Prefetch folder on a machine with significant uptime is anomalous, and the folder's own metadata plus `$UsnJrnl` entries for the deletions often survive. Wiping evidence tends to be louder than leaving it. --- Source: https://www.mytechnician.tech/labs/prefetch-files-windows-11-proving-execution/ — My Technician Security Labs. Authorization: defensive. This write-up is published for defensive and educational use on systems you own or are authorized to test. More labs: https://www.mytechnician.tech/labs/