<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Prefetch Files

## PECmd (Eric Zimmerman)

```bash
# Parse single file
PECmd.exe -f "C:\Windows\Prefetch\CMD.EXE-89305D47.pf"

# Parse directory to CSV
PECmd.exe -d C:\Windows\Prefetch --csv . --csvf prefetch.csv

# Quiet mode (CSV only, no console)
PECmd.exe -d C:\Windows\Prefetch --csv . --csvf pf.csv -q

# JSON output
PECmd.exe -d C:\Windows\Prefetch --json . --jsonf pf.json
```

| Flag | Description |
|------|-------------|
| `-f` | Single Prefetch file |
| `-d` | Directory of Prefetch files |
| `--csv` | CSV output directory |
| `--csvf` | CSV filename |
| `--json` | JSON output directory |
| `-q` | Quiet mode |
| `-k` | Comma-separated keywords to highlight |

## WinPrefetchView (NirSoft)

```bash
# GUI launch
WinPrefetchView.exe

# Export to CSV
WinPrefetchView.exe /scomma prefetch_export.csv

# Specify custom Prefetch folder
WinPrefetchView.exe /folder "X:\Windows\Prefetch"
```

## Prefetch File Format (SCCA)

### Header Structure (all versions)

| Offset | Size | Field |
|--------|------|-------|
| 0x00 | 4 | Version (17, 23, 26, 30) |
| 0x04 | 4 | Signature ("SCCA") |
| 0x08 | 4 | Unknown |
| 0x0C | 4 | File size |
| 0x10 | 60 | Executable name (UTF-16LE) |
| 0x4C | 4 | Prefetch hash |

### Version 30 (Windows 10/11) Additional Fields

| Offset | Size | Field |
|--------|------|-------|
| 0x80 | 64 | Last run times (8 × FILETIME) |
| 0xD0 | 4 | Run count |
| 0x64 | 4 | File metrics array offset |
| 0x68 | 4 | File metrics entry count |

### MAM Compression Header

```
Offset 0: "MAM" + version byte (0x04)
Offset 4: Decompressed size (uint32 LE)
Offset 8: Compressed data (Xpress Huffman)
```

## libscca (Python bindings)

```python
import pyscca

pf = pyscca.file()
pf.open("CMD.EXE-89305D47.pf")

print(f"Executable: {pf.executable_filename}")
print(f"Run count: {pf.run_count}")
print(f"Last run: {pf.get_last_run_time(0)}")

# All 8 last run times (Win8+)
for i in range(8):
    t = pf.get_last_run_time(i)
    if t:
        print(f"  Run {i}: {t}")

# File metrics (loaded files)
for i in range(pf.number_of_file_metrics_entries):
    entry = pf.get_file_metrics_entry(i)
    print(f"  {entry.filename}")
```

## Key Prefetch Files for IR

| Prefetch File | Significance |
|---------------|-------------|
| `POWERSHELL.EXE-*.pf` | Script execution |
| `CMD.EXE-*.pf` | Command prompt |
| `PSEXEC*.EXE-*.pf` | Lateral movement |
| `CERTUTIL.EXE-*.pf` | Download/decode abuse |
| `RUNDLL32.EXE-*.pf` | DLL execution |
| `MSHTA.EXE-*.pf` | HTA execution |
| `WMIC.EXE-*.pf` | WMI abuse |
| `NET.EXE-*.pf` | Reconnaissance |
| `SCHTASKS.EXE-*.pf` | Persistence |
| `REG.EXE-*.pf` | Registry modification |
