The reason why I used railgun at first was because I didn't know there was other ways you could read information from specific file offsets. I honestly don't know how big the prefetch files can get. I have a fairly recent install of win7 and the biggest pf files are 1-2megs atm. Since I only need to read less than 100 bytes from each file it might be a bit overkill to read all the files(especially if there can be 128 of those files) and then parse the results. If I understood correctly read_file returns the whole file as string instead of just specific bytes of the file which starts to add up if the files are 1-2megs and there's 128 of them.