Skip to main content

A Python script to carve Windows Prefetch artifacts from arbitrary binary data

Project description

Python script to carve Windows Prefetch artifacts from arbitrary binary data

Description

The Windows application prefetch mechanism is in place to offer performance benefits when launching applications. It’s also one of the more beneficial forensic artifacts regarding evidence of applicaiton execution. prefetch-carve.py provides functionality for carving prefetch artifacts from binary data - such as unallocated disk space, raw memory images, etc. prefetch-carve.py will output to the specified file, and supports multiple output formats.

Supported Prefetch Types

Windows 10 Prefetch files are compressed, and are unable to be carved from disk in this manner. All other Prefetch formats are supported (Windows XP - Windows 8.1)

Command-Line Options

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Carve Prefetch files from the given file
  -o OUTFILE, --outfile OUTFILE
                        Write results to the given file
  -c, --csv             Output results in csv format
  -m, --mactime         Output results in mactime format
  -t, --tln             Output results in tln format
  -s SYSTEM, --system SYSTEM
                        System name (use with -t)

Testing

Thorough teseting is still underway. I plan to integrate this project with Travis CI shortly.

Installation

Using setup.py:

python setup.py install

Using pip:

pip install prefetchcarve

Project details


Release history Release notifications

This version
History Node

1.1.2

History Node

1.1.1

History Node

1.1.0

History Node

1.0.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
prefetchcarve-1.1.2.tar.gz (3.5 kB) Copy SHA256 hash SHA256 Source None Jun 11, 2017

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging CloudAMQP CloudAMQP RabbitMQ AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page