PeCmd

How to use PeCmd to parse Windows Prefetch (.pf) files in order to provide evidence that a specific application was executed during an incident investigation.

PECmd is a command line tool developed by Eric Zimmerman, to process Prefetch files (.pf) on Windows operating systems, identifying items such as:

• Volume information

• Files and Directories referenced

• Executions time (up to last 8 for Win8+)

• Total execution count

PECmd can output the parsed prefetch files into .csv, json and HTML formats for further analysis. It should be noted that Windows Servers do not have prefetch enabled by default, information on enabling this service can be found on Darkcybe - Evidence of Execution

Tool Name	Version	MITRE ATT&CK Tactic	MITRE ATT&CK Technique
PeCmd	V1.5	Execution

Instructions

Parsing a Single Prefetch File

Parses the prefetch file for bad.exe and writes the output to a .csv file for further analysis. A single entry will be returned to STDOUT

PECmd.exe -f \PATH\TO\bad.exe-2222BD1A.pf

Output

Parsing all Prefetch Files within a Directory

Parses all prefetch files within a supplied directory. The example depicts parsing all .pf files within the default Windows prefetch directory and writes the output to a .csv file for further analysis. The q switch prevents the tool from printing the results to STDOUT. Two files will be output, a standard parsing of the entries Prefetch directory and a second timeline view of individual application executions.

PECmd.exe -d “E:\Windows\Prefetch” –csv “G:\Cases\001\Suspect_Machine_1\Prefetch_all.csv -q

Interesting Fields

• SourceCreated = .pf Creation Timestamp

• SourceModified = .pf Modification Timestamp

• SourceAccessed = .pf Last Access Timestamp (Will be overwritten by tooling)

• ExecutableName = Name of executable

• RunCount = Amount of times executed

• LastRun = Timestamp of last execution

• PreviousRun# = Timestamps of previous executions

Output

Date/Time of Execution Prefetch files are created roughly ~10 seconds after an executable is executed, therefore the modification (last execution) and creation (first execution) DTG’s may be 10 seconds after displayed times on the prefetch listings. {: .prompt-info }

Sources

• Eric Zimmerman