thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Prefetch

Windows files that record application execution details to speed up program loading, valuable as evidence of execution.

Definition

Prefetch files (.pf) in C:\Windows\Prefetch record the executable name, run count, last run times (up to eight on Windows 8 and later) and files referenced. They prove a program ran even if it was later deleted. Prefetch is often disabled on servers by default.

Example

CMD.EXE-0BD30981.pf showing a run at 02:14 during the incident window.

Exam tip

Prefetch proves execution and timing; it is commonly disabled on Windows Server.

Related terms