> For the complete documentation index, see [llms.txt](https://greenhat.gitbook.io/interview-bank/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://greenhat.gitbook.io/interview-bank/blue-team/windows-prefetching.md).
# Windows Prefetching
## Introduction
Prefetching is a Windows memory management process in which the operating system pre-loads resources from disk into memory as a means of speeding up the loading time for applications. As part of its process, a .pf file is created in the **C:\Windows\Prefetch** directory and updated each subsequent time the application is executed.
The .pf file contains a list of resources, including files and directories that the executable referenced during execution, which is used to pre-load those resources the next time the application is executed.
Prefetch Directory Listing
### **What is the use of Prefetch Files?**
1. These files are used to study the behavior of the Application means which application executes automatically or not etc
2. Prefetch files can be used for **forensic analysis of the particular Application.**
3. Analysis of the viruses can be studied with the **help of prefetch files.**
## Prefetch file properties
Prefetch files are **enabled by default on all Windows operating systems.**
Prefetch, however, is **disabled by default on Windows server operating systems** and can be enabled through the registry.
In every windows OS there's a limitation of prefetch files
| Version | Maximum File |
| ---------- | ------------ |
| Windows XP | 128 |
| Windows 7 | 128 |
| Windows 8 | 1024 |
| Windows 10 | 1024 |
### **Prefetch configuration from the Registry**
Prefetch can be configured from the registry. The path of the prefetch configuration in the registry is:
“*HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters*”
Prefetcher is enabled and the data value is 3. You can change the configuration of prefetcher by changing the data value.
There are 4 values to enable prefetcher:
| | |
| - | -------------------------------------------------- |
| 3 | Enable Prefetcher for application startup and Boot |
| 2 | Enables Boot prefetching |
| 1 | Enables Prefetcher for application startup |
| 0 | Disables Prefetcher |
## How Investigators Use Prefetch File Contents
The prefetch file, while not intended for analysis, can provide a wealth of information for an investigator. When opened, a prefetch file can show:
* Creation date – timestamped with the local time of the machine
* Date/time of last execution time – timestamped with the local time of the machine
* Run count – the number of times the executable has been launched
* Other run times – limited to the previous eight (8) executions
* Directories and files referenced – includes other executables
* Volumes and file paths – the location from which files were accessed
## **Example walkthrough**
### **This is one of the question from sherlock (campfire-1)**
*What is the full path of the tool used to perform the actual kerberoasting attack?*
Given the prefetch folder we are going to find the tool is used for the attacking, and the full path of the files
{% embed url="" %}
We are using this PECmd.exe to perform the tasks.
```
PECmd.exe -d prefetch --csv . --csvf prefetch.csv
```
pointing the directory to prefetch folders and process them output it in csv format
Scrolling abit we found the tool to be **Rubeus.exe** .
To individually analyse the file we can directly parse the file to Pecmd.exe
{% code overflow="wrap" %}
```
PECmd.exe -f prefetch\RUBEUS.EXE-5873E24B.pf
```
{% endcode %}
### *When was the tool executed to dump credentials?*
Since we know the attacker uses Rubeus.exe
Pecmd also provides the timestamp of the application is executed
## Author
Ik0nw
## Interview Question
1\) What is prefetch files?
2\) Does Windows Server enable prefetching by default?
3\) What is the maximum prefetch file for windows 11?
