Windows Prefetch Parser (pf)

pf is a Windows prefetch parser.  The prefetcher is a component of Windows operating systems starting with Windows XP that allows the system to speed up the boot process as well as decreases the time it takes to start up programs.  From a forensic perspective, any prefetch files that are created allow the investigator to determine when certain programs and associated libraries were last executed.

Whether operating pf on a live system or offline, the command line options allow pf to be operated in batch mode to process many files in an automated fashion.