Difference between pages "Windows Prefetch File Format" and "User:Bethan Williams"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Section D)
 
m (Creating user page with biography of new user.)
 
Line 1: Line 1:
A Windows Prefetch file consists of one file header and multiple file sections with different content. Not all content has an obvious forensic value.
+
Bethan is Head of Marketing at CY4OR and has worked for the Company for 5 years. With over 12 years experience in both B2B and B2C market sectors, I have a varied skill set ranging from more traditional marketing techniques through to online and social media campaign management.
  
As far as have been possible to ascertain, there is no public description of the format. The description below has been synthesised from examination
+
At CY4OR I am responsible for creating, communicating and delivering customer value through creative sales and marketing .
of multiple prefetch files.
+
 
+
== Header ==
+
 
+
This format has been observed on Windows XP, ...  will need to be modified for Vista/Win7 format
+
 
+
{| class="wikitable"
+
|-
+
! Field
+
! Offset
+
! Length
+
! Type
+
! Notes
+
|-
+
| H1
+
| 0x0000
+
| 4
+
| DWORD
+
| ? Probably a version number, identifying the file structure. Observed values: 0x11 - Windows XP; 0x17 - Vista, Windows 7
+
|-
+
| H2
+
| 0x0004
+
| 4
+
| DWORD
+
| ? Probably a file magic number. Only observed value: 0x41434353
+
|-
+
| H3
+
| 0x0008
+
| 4
+
| DWORD?
+
| ? Observed values: 0x0F - Windows XP, 0x11 - Windows 7
+
|-
+
| H4
+
| 0x000C
+
| 4
+
| DWORD
+
| Prefetch file length.
+
|-
+
| H5
+
|0x0010
+
| 60
+
| USTR
+
| Name of executable as Unicode string, truncated after character 29 if necessary, and terminated by U+0000. As it appears in the prefetch file file name.
+
|-
+
| H6
+
|0x004C
+
|4
+
|DWORD
+
|The prefetch hash, as it appears in the pf file name.
+
|-
+
| H7
+
|0x0050
+
|4
+
|?
+
|? Observed values: 0 for almost all prefetch files (XP); 1 for NTOSBOOT-B00DFAAD.pf (XP)
+
|-
+
| H8
+
| 0x0054
+
| 4
+
| DWORD
+
| Offset to section A
+
|-
+
| H9
+
| 0x0058
+
| 4
+
| DWORD
+
| ? Nr of entries in section A
+
|-
+
| H10
+
| 0x005C
+
| 4
+
| DWORD
+
| Offset to section B
+
|-
+
| H11
+
| 0x0060
+
| 4
+
| DWORD
+
| Nr of entries in section B
+
|-
+
| H12
+
| 0x0064
+
| 4
+
| DWORD
+
| Offset to section C
+
|-
+
| H13
+
| 0x0068
+
| 4
+
| DWORD
+
| Length of section C
+
|-
+
| H14
+
| 0x006C
+
| 4
+
| DWORD
+
| Offset to section D
+
|-
+
| H15
+
| 0x0070
+
| 4
+
| DWORD
+
| ? Probably the number of entries in the D section header
+
|-
+
| H16
+
| 0x0074
+
| 4
+
| DWORD
+
| Length of section D
+
|-
+
| H17
+
| 0x0078
+
| 8
+
| FTIME
+
| Latest execution time of executable (FILETIME)
+
|-
+
| H18
+
| 0x0080
+
| 16
+
| ?
+
| ? Possibly structured as 4 DWORD. Observed values: /0x00000000 0x00000000 0x00000000 0x00000000/, /0x47868c00 0x00000000 0x47860c00 0x00000000/
+
|-
+
| H19
+
| 0x0090
+
| 4
+
| DWORD
+
| Execution counter
+
|-
+
| H20
+
| 0x0094
+
| 4
+
| DWORD?
+
| ? Observed values: 1, 2, 3, 4, 5, 6 (XP)
+
|-
+
|}
+
 
+
It's worth noting that the name of a carved prefetch file can be restored using the information in field H5 and H6, and its size can be determined by field H4.
+
 
+
== Section A and B ==
+
 
+
The content of these two sections is unknown.
+
 
+
== Section C ==
+
 
+
== Section D ==
+
 
+
Section D begins with one or more headers. The number is (most likely) determined by the DWORD at file offset 0x0070. Each header refers to a hard drive.
+
 
+
In this sections, all offsets are assumed to be counted from the start of the D section.
+
 
+
{| class="wikitable"
+
|-
+
! Field
+
! Offset
+
! Length
+
! Type
+
! Notes
+
|-
+
| DH1
+
| 0x0000
+
| 4
+
| DWORD
+
| Offset to volume string (Unicode, terminated by U+0000)
+
|-
+
|}
+
 
+
If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).
+

Revision as of 13:26, 16 February 2012

Bethan is Head of Marketing at CY4OR and has worked for the Company for 5 years. With over 12 years experience in both B2B and B2C market sectors, I have a varied skill set ranging from more traditional marketing techniques through to online and social media campaign management.

At CY4OR I am responsible for creating, communicating and delivering customer value through creative sales and marketing .