File based forensic artifacts

Prefetch files

  • Useful to determine evidence of execution
  • Only enabled on non-server Windows Versions.
1
File based forensic artifacts Prefetch files Useful to determine evidence of execution Only enabled on non-server Windows Versions.