Getting Started with Windows Prefetch

https://www.tcm.rocks/certs-y - New forensics coursework (and possible cert) coming later this year! Until then, check out our existing blue team certifications, like the PSAA (Practical SOC Analyst Associate) and PSAP (Practical SOC Analyst Professional). What is Windows Prefetch? And why does Windows use it? Most importantly, how can we use it to our advantage as forensic examiners? It turns out, Windows Prefetch can provide some solid evidence of program execution. You can learn a surprising amount from it - even without using any forensic tools. Andrew Prince walks you through all of the…