Read a Windows prefetch file: what ran, when, and how often PREFETCH
Windows writes a prefetch file to speed the next launch, and in doing so keeps what the filesystem does not: that a program ran, the last times it did, how many times in total, and what it loaded.
1. The prefetch file
A .pf from C:\Windows\Prefetch. It is read here and never written to, and nothing is uploaded.
No file open yet.
2. What it shows
How it works
What this proves, and what it does not
A prefetch entry is proof that a program ran, and when - evidence that outlives the program being deleted. It does not say who ran it or why, prefetch can be turned off or cleared, and an absent file is not proof a program never ran. Corroborate against the registry, the event logs and SHORTCUT and MFT. Hash the copy with CHECKSUM and record its source with CHAIN first.
Doing this often? The Sovereign Console loads disk images and Windows artefacts into one case, and puts every timestamp on one timeline. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.