This lecture explains what the Windows prefetch artifact is and why it is one of the core windows forensic artifacts examiners use for investigations.

This lecture reviews the forensic value of the Windows prefetch artifact and goes over how examiners should approach incorporating prefetch evidence into an investigation.

This lecture breaks down the windows prefetch artifact into its different forensic components to help examiners better understand the information the artifact contains.

Windows prefetch files will have different file headers depending on the operating system that generated the prefetch artifact. Knowing how to identify and how to differentiate between the different file headers becomes important during forensic interpretation and recovery processes, such as carving for prefetch files from unallocated space.

The associated windows prefetch registry key provides additional insight into the use of the Windows prefetch on the system under investigation. This lecture reviews the registry settings that may impact an investigation.

This lecture reviews additional caveats that are important to understand when working with Windows prefetch evidence.

This section covers several validation exercises that will demonstrate how user driven activity affects the prefetch artifact. These are "live" demos that you may follow along with by downloading WinPrefetchView and using any executable to test.

Download

WinPrefetchView: http://www.nirsoft.net/utils/win_prefetch_view.html

This lecture validates what happens to the artifact when a new executable is run for the first time.

This lecture validates what happens to the artifact when an executable is run multiple times on the system.

This lecture validates what happens to the artifact when an executable is run from a USB device on the system.

This lecture validates what happens to the artifact when an executable that has been run on the system is deleted and the system is rebooted.

This lecture reviews the artifact support files for each executable and there forensic value.

Sometimes when an application is "shut down" by a user the application does not completely exit, rather the application only minimizes itself and runs in the background. Under these circumstances the application is only truly shut down when the computer is turned off or the user kills the background task. This lecture reviews the affect on the artifact under these circumstances.

This lecture examines the Ccleaner Application prefetch evidence using the knowledge gained from the validation exercises to demonstrate practical interpretation of the artifact for investigations.

This section reviews several computer forensic tools that maybe used to examine prefetch evidence. Each section goes over how to acquire, set up and use the tool as well as a review of the typical findings each tool will produce.

Attached is sample Windows prefetch data you can use for the forensic tool exercises. The sample is from a Windows 10 system, therefore if you're not using a Windows 8 or Windows 10 operating system you may not be able to decode the Windows prefetch format for viewing.

This lecture walks you through the process of setting up and using FTK Imager on your Windows forensic system. Demo system is Windows 10.

FTK Imager: https://accessdata.com/product-download

This lecture walks you through the process of setting up and using WinPrefetchView on your Windows forensic system. Demo system is Windows 10.

Downloads:

WinPrefetchView: http://www.nirsoft.net/utils/win_prefetch_view.html

This lecture walks you through the process of setting up and using CDQR on your Windows forensic system. Demo system is Windows 10.

Downloads:

CDQR: https://github.com/rough007/CDQR/releases

Plaso: https://github.com/log2timeline/plaso/releases

This lecture walks you through the process of installing and using RegRipper on your Windows forensic system. Demo system is Windows 10.

Downloads:

RegRipper:  https://github.com/keydet89/RegRipper2.8

This lecture walks you through the process of installing Windows Prefetch Parser on your Windows forensic system. Demo system is Windows 10.

Downloads:

WindowsPrefetchParser:  https://github.com/PoorBillionaire/Windows-Prefetch-Parser

Python: https://www.python.org/downloads/windows/

This lecture walk you through using Windows Prefetch Parser on your Windows forensic system. Demo system is Windows 10.

This lecture wraps up what we have learned about the Windows prefetch and its application in computer forensic investigations.

Thank you for checking out the Surviving Digital Forensic Training Series!

Be sure to check out the other classes in the series here at Udemy.

Check out the Digital Forensics Survival Podcast and listen to talk about computer forensic analysis, techniques, methodology, tool reviews and more http://digitalforensicsurvivalpodcast.com