Read a Windows Prefetch File: What Ran, When, and How Often PREFETCH
Windows writes a prefetch file to speed the next launch, and in doing so keeps what the filesystem does not: that a program ran, the last times it did, how many times in total, and what it loaded.
1. The prefetch file
A .pf from C:\Windows\Prefetch. It is read here and never written to, and nothing is uploaded.
Drop a .pf here, or open one
Windows 7 and 8 files read directly; a decompressed Windows 10/11 file too.
No file open yet.
2. What it shows
What this proves, and what it does not
A prefetch entry is proof that a program ran, and when - evidence that outlives the program being deleted. It does not say who ran it or why, prefetch can be turned off or cleared, and an absent file is not proof a program never ran. Corroborate against the registry, the event logs and SHORTCUT and MFT. Hash the copy with CHECKSUM and record its source with CHAIN first.