Windows Prefetch
| Format | Windows Prefetch |
|---|---|
| Short name | Prefetch |
| Category | execution |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Windows execution evidence artifacts created when an application is run for the first time from a specific path. Stored under C:\Windows\Prefetch\ as {EXECUTABLE}-{HASH}.pf, where HASH is derived from the executable's full device path (for hosting processes such as svchost.exe or rundll32.exe also from the command line). Enabled by default on Windows workstations; disabled on Windows Server. Each .pf file contains: executable name, run count, up to 8 last execution timestamps (Windows 8+ — earlier versions store 1), list of files and directories accessed in the first 10 seconds of execution, and volume serial number and creation timestamp. Note: actual execution time is approximately 10 seconds before the .pf file's last modification timestamp. Forensically: proves execution even if the original binary was deleted, reveals path from which malware was executed, detects anti-forensic tools (CCleaner, SDelete prefetch entries). Multiple .pf files for the same executable indicate execution from different paths. Since Windows 10 the files are stored compressed in a MAM container (LZXPRESS Huffman); the SCCA header is only visible after decompression. Format reversed by Joachim Metz (libscca); no official public specification.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 11 00 00 00 53 43 43 41 | ....SCCA | Prefetch v17 header (Windows XP/2003) |
| offset 0 (0x0) | 17 00 00 00 53 43 43 41 | ....SCCA | Prefetch v23 header (Windows Vista/7) |
| offset 0 (0x0) | 1A 00 00 00 53 43 43 41 | ....SCCA | Prefetch v26 header (Windows 8.0/8.1) |
| offset 0 (0x0) | 1E 00 00 00 53 43 43 41 | ....SCCA | Prefetch v30 header (Windows 10, decompressed) |
| offset 0 (0x0) | 1F 00 00 00 53 43 43 41 | ....SCCA | Prefetch v31 header (Windows 11, decompressed) |
| offset 0 (0x0) | 4D 41 4D 04 | MAM. | Compressed prefetch file, MAM container 'MAM\x04' (Windows 10+) |
Known extensions
.pf
References
- Windows Prefetch File format spec (libscca — Joachim Metz) https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc
- Prefetch forensics — execution evidence (Magnet Forensics) https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/
- PECmd — Prefetch parser (Eric Zimmerman) https://ericzimmerman.github.io/#!index.md
- ForensicsWiki — Prefetch https://forensics.wiki/prefetch/
Cite this entry
Crush Format Reference, “Windows Prefetch”. https://kalink0.github.io/crush-forensics/formats/prefetch/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction