Incident Response & Computer Forensics by Jason T. Luttgens

Author:Jason T. Luttgens
Language: eng
Format: epub
Tags: -
Publisher: McGraw-Hill Education
Published: 2014-07-01T16:00:00+00:00

The Evidence

Prefetch files are stored in %SYSTEMROOT%\Prefetch. In this directory, you will find the following files:

• NTOSBOOT-B00DFAAD.pf  The system boot prefetch. This always has the same name. On Windows Servers, this is the only prefetch file that will exist by default.

• Layout.ini  Contains data used by the disk defragmenter.

• AppName-########.pf  Up to 128 application-specific prefetch files, each with the extension .pf, and each representing an executable file that ran at least once. These files are named by concatenating the executable name, a dash, and a 32-bit hexadecimal hash derived from the file’s path. That means that the same executable, if ran from two different paths, will have two different prefetch files.

Figure 12-8 displays the partial contents of the C:\Windows\Prefetch directory on a drive image loaded in FTK imager.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.