Difference between pages "User talk:Athulin" and "Windows Prefetch File Format"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Work in progress)
 
(Created page with "A Windows Prefetch file consists of one file header and multiple file sections with different content. Not all content has an obvious forensic value. As far as have been possibl...")
 
Line 1: Line 1:
Experimenting with my talk page
+
A Windows Prefetch file consists of one file header and multiple file sections with different content. Not all content has an obvious forensic value.
  
== Work in progress ==
+
As far as have been possible to ascertain, there is no public description of the format. The description below has been synthesised from examination
 +
of multiple prefetch files.
  
This will be submitted when I feel I've got everything under control.
+
== Header ==
  
[[Windows Prefetch File Format]]
+
== Section A and B ==
 +
 
 +
== Section C ==
 +
 
 +
== Section D ==

Revision as of 09:34, 14 September 2011

A Windows Prefetch file consists of one file header and multiple file sections with different content. Not all content has an obvious forensic value.

As far as have been possible to ascertain, there is no public description of the format. The description below has been synthesised from examination of multiple prefetch files.

Header

Section A and B

Section C

Section D