01Location
- C:\Windows\Prefetch\<EXECUTABLE>-<HASH>.pf
- SYSTEM hive: ControlSet00n\Control\Session Manager\Memory Management\PrefetchParameters (value EnablePrefetcher)
02Questions it answers
- Was a given executable run on this system, and how many times?
- When were its most recent executions (up to eight on Windows 8 and later)?
- Which DLLs, data files and directories are listed in the trace for the program?
- From which volume (device path, serial number, creation time) were the referenced files loaded?
03Format and versions
| Format | Binary SCCA structure: little-endian, UTF-16LE strings, FILETIME values in UTC. Format version 17 (XP/2003), 23 (Vista/7), 26 (8.0/8.1), 30 (Windows 10), 31 (Windows 11). From Windows 10 the file is wrapped in a MAM container (signature MAM\x04) compressed with LZXPRESS Huffman. |
|---|---|
| Applies to | Windows XP to Windows 11. Versions 17 and 23 store one last run time; version 26 and later store eight. |
04Key fields
| Field | What it tells you |
|---|---|
| Executable filename | UTF-16LE name of the executable, stored with at most 29 characters; also part of the .pf file name. |
| Prefetch hash | 32-bit value calculated from the upper-case device path of the executable (e.g. \DEVICE\HARDDISKVOLUME1\WINDOWS\NOTEPAD.EXE); it should match the hash in the file name. |
| Run count | Number of recorded executions. |
| Last run time(s) | One FILETIME (v17/v23) or an array of eight (v26+), most recent first; unused slots contain 0. |
| Filename strings | Array of UTF-16LE paths of files recorded in the trace. |
| Volume information | Per volume: device path, volume serial number, volume creation time, NTFS file references and directory strings. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Last run time (×1 in v17/23, ×8 in v26+) | FILETIME (UTC) | The first entry is the most recent run; earlier runs beyond the stored slots are reflected only in the run count. |
| Volume creation time | FILETIME (UTC) | Describes the referenced volume, not the executable or its execution. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect the whole Prefetch directory and record EnablePrefetcher from the SYSTEM hive (0 = disabled, 1 = application start, 2 = boot, 3 = both).
- Decompress MAM files from Windows 10 and later before parsing; PECmd, for example, cannot process Windows 10 Prefetch on hosts older than Windows 8.
- Extract name, hash, run count, last run times, volume information and the file list for each .pf file.
- Use the file list and volume data to establish the full path; the same name in different folders yields different hashes and therefore separate .pf files.
- Correlate execution times with Amcache, AppCompatCache, BAM and event logs.
07Interpretation pitfalls
- The executable name is truncated to 29 characters; do not rely on it alone to identify a binary.
- A missing .pf file does not prove that a program never ran: prefetching can be disabled through EnablePrefetcher.
- Executing an NTFS alternate data stream produces a Prefetch name containing the stream name (libscca example: notepad.exe:evil.pf).
- Several header and volume fields remain undocumented; treat values marked unknown in libscca as uninterpreted.
09Sources
- Windows Prefetch File (PF) format libyal / libscca (J. Metz) · checked 2026-10-14
- Prefetch (PrefetchParameters key) libyal / winreg-kb · checked 2026-10-14
- PECmd README Eric Zimmerman (GitHub) · checked 2026-10-14