PECmd (prefetch)

PECmd.exe -d C:\Windows\Prefetch --csv <out>

Parse Prefetch files with PECmd, obtaining program executions with their dates and the files they loaded.

Run it when you need the system's program execution record: Prefetch (C:\Windows\Prefetch) stores a file for each launched executable, with first and last execution, execution count, and the files the program loaded. PECmd converts it to CSV. It's the most used execution artifact in Windows IR: the attacker's payload, tools, and even one-liners appear in Prefetch. In IR, it answers 'what was executed and when?' with execution details — and the loaded files reveal the scripts and DLLs the binary used.

Don't use it if Prefetch is disabled (servers, systems with active policy) or rotated (Prefetch is pruned): without files, there's no record — for those cases, use Amcache and ShimCache. Prefetch only records programs that go through the mechanism: scripts (PowerShell, cmd) don't generate Prefetch, and binaries loaded in memory don't either. And watch out: the attacker deletes Prefetch (it's one of the first artifacts they clean); the absence of Prefetch for an expected program or mass deletion of files is also a finding. For temporal correlation, Prefetch timestamps are contrasted with the MFT.