Lion Cipher Lab
Prove a program ran with Windows Prefetch
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Half of every intrusion investigation comes down to one question: did this thing actually run on this machine, and when? A firewall log shows a connection, an email shows a lure, a dropped file shows intent — but none of them prove the payload executed. Windows Prefetch does. Prefetch is a performance feature: to make programs launch faster the operating system watches what an executable reads during its first ten seconds of startup and writes a small `.pf` file so it can pre-load those pages next time. As a side effect it records, per executable, that the program ran, how many times, the…
What you'll learn
- explaining what Windows Prefetch is, why it exists as a performance feature, and why DFIR repurposes it as execution evidence
- reading the .pf naming scheme (NAME-HASH.pf) and knowing the hash encodes the executable's full path, so two same-named binaries from different folders produce different .pf files
- generating your own ground-truth prefetch by running known programs a known number of times, then verifying the parser against reality
- parsing a single .pf with PECmd -f and a whole folder with PECmd -d --csv, and reading the executable name, run count, the up-to-eight last-run times, and the referenced-files list
- distinguishing the single run COUNT from the up-to-eight distinct last-run TIMES, and building a mini execution timeline from them
- using the referenced-files list to recover a dropper's staging path or a deleted binary's former location, and answering 'did evil.exe ever run here?'
- correlating prefetch with Amcache, ShimCache, the $MFT and event logs instead of trusting one artifact
- stating prefetch's honest limits: it can be disabled, is often off on Server, caps at ~1024 entries, and proves execution but not identity or privilege
Steps in this lab
- What Prefetch is, and why a speed feature is forensic gold
- Confirm prefetch is on, then look at your own Prefetch folder
- Manufacture ground truth: run a known program a known number of times
- Get PECmd, Eric Zimmerman's prefetch parser
- Parse a single .pf: read the run count, the eight times, the referenced files
- Parse the whole folder and build a mini execution timeline
- The payoff: 'did evil.exe ever run here?' and where did it run from
- Judgment: when prefetch is your friend, and how a pro uses it
- The honest negative: what prefetch CANNOT tell you