If you want to try to carve Windows Prefetch files from arbitrary binary data, there is a tool for you - Windows Prefetch Carver by Adam Witt. It can be used for prefetch carving from a drive's unallocated space or a memory image, for example. In this recipe we will show you how to use it.
Prefetch file recovery with Windows Prefetch Carver
Getting ready
Go to the Windows Prefetch Carver GitHub page (presented in the See Also section), and download the archive using the green Clone or Download button. Unpack the archive, start the Windows Command Prompt, and change the directory to the folder you unpacked it into. You are ready to go!