R&D-2 Page

Pre-requisites

1. Admin privileges (to access C:\Windows\Prefetch)
2. Prefetch enabled on system (EnablePrefetcher registry key)
3. Copy .pf files for analysis (never analyze directly from system)

Let’s start step by step execution

1.1.1  Extract Prefetch Files

1. Navigate to: C:\Windows\Prefetch\

1. Copy all .pf files to a working directory (e.g., D:\Forensics\Prefetch)

Because we don’t want to destroy the original files that is present, also cloning the files will make sure the evidence is safe.