What a Windows prefetch file shows, and what it does not

A prefetch file shows that a program ran: its name, when it last ran (the last eight times on Windows 8, 10 and 11), how many times it has run in total, every file it loaded in its first seconds, and the volumes it read from, with their serial numbers. It does not show who ran it or what they did with it. On Windows 10 and 11 the file is compressed, which is why opening it in a text or hex editor shows nothing useful. PREFETCH decompresses and reads it in your browser, on any computer, and nothing is uploaded.

Where the files are

In C:\Windows\Prefetch, one per program and path, named like CALC.EXE-3FBEF7FD.pf. The hex after the dash is a hash of the path the program ran from, so the same program run from two places has two files, and a program run from a USB stick has a different hash from the installed copy. Copying them out needs an administrator account.

Prefetching can be turned off, and Windows Server has it off by default. An empty or missing Prefetch folder on a desktop is itself worth noting.

What is in one

This is a real Windows 10 prefetch file for the Calculator, from a public forensic test set, as PREFETCH reads it:

The paths in a Windows 10 file start with \VOLUME{01d1217a9c4c6779-8c9f49ec} rather than a drive letter. The second half of that is the volume serial, and the first half is the volume's creation time as a FILETIME, so the name and the volume record agree with each other: a small internal consistency check you can do by eye.

Reading one without installing anything

1. Copy the .pf files you need out of C:\Windows\Prefetch, and take a hash of each before you do anything else if the result may be relied on. CHECKSUM does that in the browser.
2. Open PREFETCH on any computer, including a Mac or a phone, and drop a file on it. A Windows 10 or 11 file is expanded in the tab first, and the result says so and gives both sizes.
3. Read the table, the run times and the list of files. The search box filters the file list, which is the quickest way to find a document or a drive letter.

Until this page was written PREFETCH refused compressed files and told you to expand them with another tool first, which meant every file a current Windows machine writes. It also read an expanded file at the wrong offsets, so the run count and run times it showed were not the ones in the file; its only test was a file built to those same wrong offsets. It now decompresses LZXPRESS Huffman itself, to Microsoft's published specification, and reads each version at the offsets documented by libscca. Its expansion of the file above matches an independent decompressor byte for byte.

What a prefetch file does not tell you

• Who ran it. There is no user account in the file. That has to come from somewhere else, such as the user's registry hive or the Security event log.
• What it did. The list of files is what the program loaded in roughly its first ten seconds, which is often its libraries and sometimes the document it was opened with. It is not a log of everything it touched.
• Every run. The count is a total, and only the last eight times are kept. A ninth run pushes the oldest time out.
• Absence. No prefetch file does not mean the program never ran. Prefetching may be off, the file may have been deleted, and Windows keeps a limited number of them and removes the oldest.
• Exact launch time. The times are the machine's own clock, in UTC, as Windows recorded them; allow a few seconds against the moment the program was started, and check the machine's clock was right.

For the rest of what shows a USB drive was used on the same machine, see how to tell if a USB drive was plugged into a PC.