665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-prefetch-files-for-execution-history

Parse Windows Prefetch files to extract execution history and timestamps.

Updated Aug 27, 2026

Search Tags:#prefetch #incident-response #digital-forensics #execution-history #windows-forensics #timeline-analysis

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-prefetch-files-for-execution-history

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-prefetch-files-for-execution-history
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-prefetch-files-for-execution-history
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-prefetch-files-for-execution-history

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires lznt1, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Analyzing Prefetch artifacts provides a reliable way to reconstruct program execution history on Windows, including run counts, timestamps, and referenced files, which is essential for incident response and digital investigations.

Core Features & Use Cases

Parses Windows Prefetch versions 17, 23, 26, and 30 to extract execution metadata.
Builds a timeline of executable activity and identifies suspicious tool usage.
Supports cross-reference with other artifacts to establish comprehensive incident narratives.

Quick Start

Run the analysis agent against the Prefetch directory to generate a structured execution history report.

Frequently Asked Questions about analyzing-prefetch-files-for-execution-history

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I parse Windows Prefetch files for execution history in incident response?▼

Parse Windows Prefetch files to recover program execution history by extracting run counts, timestamps, and referenced files. This builds a structured execution timeline to support forensic investigations and incident response narratives.

What Prefetch versions are supported when analyzing execution timelines?▼

Analyzing Prefetch execution history supports Windows Prefetch versions 17, 23, 26, and 30. Version-aware parsing extracts executable metadata and run counts across different Windows operating system iterations for timeline reconstruction.

Can I identify suspicious tools using Prefetch file analysis?▼

Prefetch file analysis identifies suspicious tool usage by comparing referenced files and executable metadata against a built-in suspicious tool list. This detects anomalous program execution during digital forensic investigations.

Does Prefetch parsing work with the lznt1 dependency for decompression?▼

Prefetch parsing relies on the lznt1 dependency to handle compressed artifacts. This decompression step is required to access the internal structures containing run counts, timestamps, and referenced files for forensic analysis.

What is the best way to reconstruct a program execution timeline from Windows Prefetch artifacts?▼

Reconstruct a program execution timeline by running analysis against the Prefetch directory to extract run counts and timestamps. This generates a structured forensic report detailing executable activity and referenced artifacts across endpoints.

Related Skills

Explore More Data & Analytics Skills→

$refractionPOINT$ refractionPOINT

velociraptor

Launch Velociraptor forensic collections on endpoints via LimaCharlie API.

performing-log-analysis-for-forensic-investigation

Collect, parse, and correlate Windows EVTX, Linux syslog, and web access logs into a unified forensic timeline.

performing-endpoint-forensics-investigation

Identify and document endpoint compromises through Windows digital forensics investigations.

Windows Artifacts (EZ Tools / Autoruns / Event Logs)

Parse Windows forensic artifacts into CSV outputs for DFIR triage.