Windows registry artifactPrefetch Status
0 = Disabled, 1 = Application Prefetching Enabled, 2 = Boot Prefetching Enabled, 3 = Application and Boot Prefetching Enabled
- System Info
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMEnablePrefetcherControlSet00*\Control\Session Manager\Memory Management\PrefetchParameters0 = Disabled, 1 = Application Prefetching Enabled, 2 = Boot Prefetching Enabled, 3 = Application and Boot Prefetching Enabled
References
6 links
- thewindowsclub.com/disable-superfetch-prefetch-ssd(opens in new tab)
- youtu.be/f4RAtR_3zcs(opens in new tab)
- resources.infosecinstitute.com/topic/windows-systems-artifacts-digital-forensics-part-iii-prefetch-files/(opens in new tab)
- hackingarticles.in/forensic-investigation-prefetch-file/(opens in new tab)
- countuponsecurity.com/2016/05/16/digital-forensics-prefetch-artifacts/(opens in new tab)
- or10nlabs.tech/prefetch-forensics/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)