Application: Prefetch Parser
Created By: Paul Hutelmyer
Description: Prefetch files are used in the Windows Operating system to optimize the loading time of a Windows application on subsequent runs. These files contain information about the files loaded by the application. Prefetch Parser outputs the content of a prefetch file. By using this application, you can get a better understanding on what has executed on your machine.
The following is extracted:
Multiple Prefetch Files
While this application does not natively support multiple prefetch files(yet), just use a script iterate through the multiple files. See below for an example in Windows batch:
::Prefetch.bat ::For every .PF file in the Windows\Prefetch directory, Call Prefetch.exe ::Prefetch.exe parses each prefetch file and gathers dates/file paths. ::Passes values to PrefetchResults.txt ::Created by Paul Hutelmyer @echo off ECHO Running Prefetch Analysis... if exist PrefetchResults.txt DEL prefetchresults.txt for /F %%i IN ('dir /b %SYSTEMROOT%\prefetch\*.pf') DO ( WindowsPrefetch.exe %SYSTEMROOT%\prefetch\%%i >> PrefetchResults.txt ) ECHO Done!