Windows Forensics Cookbook

How to do it...

The steps for prefetch file parsing with PECmd are as follows:

1. Using the Windows Command Prompt, change the directory to the one where you unpacked the archive, and run the following command:

PECmd.exe -f C:\Users\Admin\Desktop\Prefetch\ACRORD32.EXE-41B0A0C7.pf

You will see the output very shortly, as in the following figure:

Figure 7.24. PECmd output

2. As you can see in the preceding figure, we can get the executable name, its run count, timestamps of the last eight runs, and even lists of directories and files references. Not bad, right?

You can also parse all files in a directory recursively. To do this, use the following ...