Question

Explain what Windows prefetch files are.

Answer 1

Solution :

Window Prefetch Files :

Explanation : Windows creates a prefetch file when an application is run from a particular location for the very first time, a Prefetch file which contains information about the files loaded by the application is created by Windows operating system. The information in the Prefetch file is used for optimizing the loading time of the application in the next time that you run it.

Feature And Format Of Prefetch Files:

1. These files are all stored in the ROOT/Windows/Prefetch folder and most of the files have PF extension.
2. For eg: PYTHON_3.6.1-AMD64.EXE-6F01AFF6.pf. The prefetch file for PYTHON_3.6.1-AMD64.EXE would appear as PYTHON_3.6.1-AMD64.EXE-6F01AFF6.pf.
3. Prefetchcount.py script can be used to uncompressed the prefetch files. Decompressed files can be easily converted into understandable String format.
4. 6F01AFF6 is a hash of the path from where the file was executed. This Path is encrypted with different types of Hashing Functions.
5. Maximum number of prefetch file

Windows XP to Windows 7 =128

Windows 8 to Windows 10=1024

6. On reaching the limit it automatically deletes from the folder.

Uses Of Prefetch Files:

1. These files are used to study the behavior of the Application means which application executes automatically or not etc.

2. Analysis of the viruses can be studied with the help of prefetch files.

3.Prefetch files can be used for forensic analysis of the particular Application.

Advantages of Prefetch File:

1. There are many Cleanup tools that automatically delete the prefetch files. This makes the System faster but only once then again after prefetch creates again to do there work.

2. When the capacity limit of prefetch files reached it automatically delete all the information and prefetch files. Capacity depends upon the operating system of the machine.

Cons Of Prefetch Files :

1.  Processing Power of the CPU increases as well as decrease the disk read and write speed.

2. Provide encrypted information on the executable application. So that no one can easily access the information.