Prefetch is a Microsoft Windows feature that first appeared in Windows XP. It is a Memory Manager component that can speed up the Windows boot process and reduce the time it takes for programs to start up. It achieves this by storing files required by an application in RAM as soon as the application is launched, thereby reducing disk seeks and consolidating disk reads. Prefetch is available on Windows XP, 2003, Vista, 7, 8.1, and Windows 10.
Prefetch speeds up the loading of a specific application resource, allowing you to open your most used application faster. Prefetching enables a browser to fetch the resources required to view content that will be accessed later. Prefetch files will disclose whether the individual installed and ran a particular program, tracking such information is critical during the digital forensic analysis process.
In Windows XP/7/8/10 Prefetch artifacts are located at C:\Windows\Prefetch.
The Prefetch structure contains program source code files that include:
This section will discuss how to use ArtiFast Windows to analyze Prefetch artifact from Windows machines and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Prefetch artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Prefetch artifact in ArtiFast software.