Prefetch analysis

One question that analysts will often have to answer is determining if an executable has run. One of the best sources of data to answer this question is Prefetch files. When an application or other executable is run, a file is created and stored within the C:\Windows\Prefetch directory. If the program is run in multiple locations, an entry is created for each of these. Another key aspect of Prefetch files is that they are not deleted when the application or program has been deleted. So, if an adversary is attempting to clean up the system of malicious executables or DLL files, proof of their execution may still be located in the Prefetch directory.

The Prefetch files do have some quirks that should be understood. First, even unsuccessful program execution can still produce a Prefetch file. It should be noted that the operative word is can, meaning that not every unsuccessful execution creates a file. Second, the Prefetch directory is specifically limited to 1...