Prefetch Files.

Windows .pf files in C:\Windows\Prefetch that record process startup data and provide strong forensic evidence that an executable ran on a system. It belongs to the Forensics & IR category of cybersecurity.

Windows .pf files in C:\Windows\Prefetch that record process startup data and provide strong forensic evidence that an executable ran on a system.

Prefetch is a Windows performance optimisation that records which files and directories an executable touches during its first ten seconds of execution. The resulting .pf file (named EXECUTABLE-HASH.pf) is stored in C:\Windows\Prefetch and contains the original executable path, run count, the last eight execution timestamps (Windows 8+), and a list of referenced files and volumes. Forensic analysts use prefetch to prove program execution, recover deleted binaries' names, build timelines, and spot suspicious binaries running from temp or AppData locations. Prefetch is disabled by default on Windows Server and on SSD systems in some configurations, so its absence is itself an observation. PECmd is the canonical parser.

Defences for Prefetch Files typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: .pf files, Windows Prefetch.