Hack Like a Pro: Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files) « Null Byte :: WonderHowTo

Welcome back, my aspiring hackers!Inthis series, we continue to examine digital forensics, both to develop your skills as a forensic investigator and to avoid the pitfalls of being tracked by a forensic investigator.In earlier posts inthis series, we examinedregistry filesand what they can tell us about what the user was doing when their computer was seized. Windows has another type of file system that can also reveal a treasure trove of information about the user before the machine was seized for examination—the prefetch files.Prefetch SystemObviously, Microsoft did not implement the prefetch system for forensic analysis, but rather to improve the performance of Windows. The prefetch system does what its name implies—it prefetches files that the system anticipates the user will need and loads them into memory making the "fetch" of the files faster and more efficient. It's a type of artificial intelligence that attempts to anticipate what you will need next and gets it ready for you.The beauty of the prefetch system in Windows is that it can reveal much information about what the user was doing even if they are smart enough to try to cover their tracks. Prefetch has been part of the Windows operating system since Windows XP and 2003 (those are the same build), and it is enabled by default throughWindows 10. On the server side, Windows Server 2003, 2008, and 2012, application prefetch much be enabled in the registry.These prefetch files contain metadata about the files used. This metadata includes information such as the last date the application was used, where the application files were stored, how many times the application was used, and several other pieces of useful information to the forensic investigator. This can be critical information in trying to prove that a suspect actually used an application that was involved in the crime, such as the browser or document creation software such as Word, even if it has been removed from the system.Location of PreFetch FilesYou can find the prefetch files underC:\ windows\prefetch. Here is an example of the prefetch files from a Windows 7 system (still the most widely used OS in the world).As you can see, in this\windows\prefetchdirectory, we can see all of the prefetch files. These are the files ending in.pf, but we can also see database files (.DB) as well. For now, let's focus on the.pffiles.In the first group of circled files seen above, you can see the prefetch files for bothcalc.exeandcmd.exe. In the next column, we can see the last date they were modified, which usually means the data those applications were last used.In the second highlighted area, we can see the prefetch file for the "DEVICEPAIRINGWIZARD" executable. Note that it was last used on 12/15/2015. This is the Wizard used for Bluetooth pairing. You might imagine a scenario where a suspect might have claimed that they had never used, nor knew how to use, Bluetooth paring that was used in the crime. This file would clearly argue against such a claim in court.Analyzing PrefetchAlthough we can get some basic information by simply viewing the prefetch files, we need to parse the file to get all the information it contains. There are numerous programs capable of parsing these files and all of them work pretty well, but Nirsoft's freeWinPrefetchViewis about the easiest to use with a nice, intuitive GUI (most of the forensic suites such as EnCase, FTK, and Oxygen are also capable of prefetch parsing). You can download it in either32-bitor64-bit.Simply download and install it, then run it. It will grab all the prefetch files and parse them like below.Let's take a look at that Bluetooth Device Pairing Wizard. I have circled it in the screenshot above. We can see where the path to the.exeis, the number of times it has been run, and the last time it was run. This could all be critical information in a forensic investigation. Also note in the lower pane that it lists every file used by the program with a path to the files.If we click on the "Last Run Time" tab to sort by time, we can recreate a timeline of events that took place on that system.Disabling Prefetch & SuperfetchIf the suspect were really digitally savvy, they coulddisable prefetch. They could also disable, or stop, superfetch, which was introduced with Windows Vista and works similarly to prefetch except that it preloads applications based upon your usage patterns. To disable or stop it, go to Computer Management, select Services on the left, then double-click on Superfetch and choose the wanted option.Keep coming back, my aspiring hackers, as we continue to explore digital forensics to enlighten you into the inner workings of our operating systems and keep you safe!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 5 (Windows Registry Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 11 (Using Splunk)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 8 (More Windows Registry Forensics)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Digital Forensics Using Kali, Part 1 (The Tools of a Forensic Investigator)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 2 (Network Forensics)News:Why YOU Should Study Digital ForensicsHow To:Become a Computer Forensics Pro with This $29 TrainingSPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 9 (Finding Storage Device Artifacts in the Registry)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 7 (Windows Sysinternals)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 13 (Browser Forensics)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 15 (Parsing Out Key Info from Memory)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 3 (Recovering Deleted Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 14 (Live Memory Forensics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 16 (Extracting EXIF Data from Image Files)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 10 (Identifying Signatures of a Port Scan & DoS Attack)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)News:Airline Offers Frequent Flyer Miles to HackersNews:What to Expect from Null Byte in 2015Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)Hack Like a Pro:Getting Started with BackTrack, Your New Hacking SystemHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Goodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsHow To:How Hackers Take Your Encrypted Passwords & Crack ThemGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingGoodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Don't Get Caught! How to Protect Your Hard Drives from Data ForensicsCommunity Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking Simulations