Windows Prefetch
Accessing Prefetch Files for Forensic Analysis.
A digital forensic investigation often aims to determine the activities of a user on a computer. Prefetch files are an important type of evidence, which provide detailed information about the programs that were run on a computer. A forensic examiner can use prefetch data to determine information such as which programs were executed, when they were run, and how many times.
The Purpose of Prefetch
Prefetch is a Windows feature (although Macs have analogous features) that stores data when the user runs a program. This information helps the operating system load the program faster next time. It collects this information for every program that the user runs, which makes it a valuable repository of information about what the user has been doing on the computer.
Forensic Applications of Prefetch
In an investigation, prefetch data can be used to determine if a user has been using software tools to hide or delete evidence. For example, if the forensic examination uncovers a prefetch file for CCleaner (a program often used to delete data), this could be a sign of evidence tampering or spoliation. Similarly, if an employee has used a cloud storage program such as Dropbox to take data belonging to their organization, the prefetch files likely provide evidence of that, even if the program itself has been removed from the computer.
Prefetch for Malware Detection
Prefetch data is also valuable for detecting the use of malicious software on a computer. The prefetch file can reveal when the malware was executed and where it was run from. This is critical information for determining the source of the malicious files and how they arrived on the system, which can aid in a security incident response, investigation, or litigation.
