Prefetch Basics: Windows Prefetch stores application specific data in order to help it to start quicker. Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. Windows saves this information as a number of small files in the prefetch folder. The next time you turn on your computer, Windows refers to these files to help speed the start process.
The os loads key pieces of data and code from disk into memory before it's actually needed.
Prefetch Investigation FAQ:
When you should grab prefetch file?
You can grab is before performing Incident Response as the prefetch directory is populated after the application is executed. The content of the file is pretty volatile.
How you can use it in an Investigation?
Analysis of prefetch file is common in investigation, it has wealth of information stored in it.
* It contains:
Here is what information we can glean from the prefetch: