Prefetch Files

Prefetch Files Prefetch files are created by Windows to speed up the loading process by caching the neccessary data. When we fire up a process, it will cache the details like files accessed and stores it in small file i.e. prefetch files under Prefetch subfolder in Windows. When the application is opened for the next time, it will load the files accessed. Windows Prefetch files are located in C:\Windows\Prefetch\*.pf. From forensic perspective, it provides various valuable information like ...

June 12, 2025 · 4 min · 5h4rrk

Kernel Memory Dump Analysis : Introduction

An introduction to analyzing kernel memory dumps using WinDbg.

January 30, 2025 · 98 min · 5h4rrk