A Python script to parse Windows Prefetch files
Project description
Python script created to parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files
Description
The Windows Prefetch file was put in place to offer performance benefits when launching applications. It just so happens to be one of the more beneficial forensic artifacts regarding evidence of applicaiton execution as well. prefetch.py provides functionality for parsing prefetch files for all current prefetch file versions: 17, 23, 26, and 30.
Features
Specify a single prefetch file or a directory of prefetch files
CSV
(Limited) Windows 10 support
Sort a directory of Prefetch files by all execution timestamps
Cross-platform: Windows 10 prefetch files must be parsed from a Windows 8+ workstation
Command-Line Options
For now, prefetch.py requires one of two command-line options: --file specifies a single prefetch to point the script at. --directory specifies an entire directory of prefetch files which will be parsed and printed to stdout. When using --directory / -d, remember to include the trailing slash:
dev@computer:~$ ./prefetch.py -h usage: prefetch.py [-h] [-c] [-d DIRECTORY] [-e EXECUTED] [-f FILE] optional arguments: -h, --help show this help message and exit -c, --csv Present results in CSV format -d DIRECTORY, --directory DIRECTORY Sort PF files by ALL last execution times -e EXECUTED, --executed EXECUTED Sort PF files by ALL execution times -f FILE, --file FILE Parse a given Prefetch file
–file
Using the --file / -f switch provides the output below:
dev@computer:~$ python prefetch.py -f PING.EXE-7E94E73E.pf ===================== CMD.EXE-4A81B364.pf ===================== Executable Name: CMD.EXE Run count: 2 Last Executed: 2015-11-12 17:12:21.997002 2015-11-12 17:11:16.192044 Volume Path(s): \DEVICE\HARDDISKVOLUME1 Volume Creation Time: 2015-11-12 18:01:19.222974 Volume Serial Number: ba22473f Resources loaded: 1: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NTDLL.DLL 2: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CMD.EXE 3: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\KERNEL32.DLL 4: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\KERNELBASE.DLL 5: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\LOCALE.NLS 6: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\MSVCRT.DLL 7: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CMDEXT.DLL 8: \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\ADVAPI32.DLL
–directory
By invoking the --directory / -d flag, the Analyst is able to parse an entire directory of Prefetch files at once.
–executed
Sort a directory of Prefetch files by execution time. This includes all timestamps in Windows 8+ Prefetch files (up to eight per file):
dev@computer:~$ python prefetch.py -e Prefetch/ Execution Time, File Executed 2015-11-15 00:02:39.781250, WUAUCLT.EXE-399A8E72 2015-11-15 00:02:26.281250, VERCLSID.EXE-3667BD89 2015-11-15 00:02:24.343750, WMIPRVSE.EXE-28F301A9 2015-11-15 00:02:07.453124, RUNDLL32.EXE-451FC2C0 2015-11-15 00:01:50.765626, GOOGLEUPDATE.EXE-1E123D86 2015-11-15 00:01:08, NTOSBOOT-B00DFAAD ... ... ...
–csv
Using the --csv / -c flag will provide results in CSV format:
Last Executed, Executable Name, Run Count 2016-01-20 16:01:27.680128, ADOBEIPCBROKER.EXE-c8d02fab, 1 2016-01-20 16:59:42.077480, CREATIVE CLOUD UNINSTALLER.EX-216b8ea8, 1 2016-01-19 18:07:18.101626, MSIEXEC.EXE-a2d55cb6, 37237 2016-01-20 16:11:15.818394, ACRODIST.EXE-782bc2b2, 1
Testing
Testing on the prefetch file types below has been completed successfully:
Windows XP (version 17)
Windows 7 (version 23)
Windows 8.1 (version 26)
Windows 10 (version 30)
References
This project would not have been possible without the work of others much smarter than I. The prefetch file format is not officially documented by Microsoft and has been understood through reverse engineering, and trial-and-error.
Additionally, Without the excellent work by Francesco Picasso in understanding the Windows 10 prefetch compression method, I would not have been able to get Windows 10 parsed here. I use a modified version of his decompression script in prefetch.py. Francesco’s original script can be found at the link below:
To gain a better understanding of the prefetch file format, check out the following resources; which were all used as references for the creation of my script:
Python Requirements
from argparse import ArgumentParser
import binascii
import collections
import ctypes
from datetime import datetime,timedelta
import json
import os
import struct
import sys
import tempfile
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.