Windows Prefetch File Format - Revision history

Bruce Allen: /* Header */

2012-05-18T16:30:06Z

‎Header

Athulin: /* Section D */

2012-01-20T10:37:00Z

‎Section D

Athulin: /* Section D */

2012-01-20T10:34:23Z

‎Section D

Athulin: /* Section D */

2012-01-20T10:28:34Z

‎Section D

Athulin: /* Section D */

2012-01-20T10:06:28Z

‎Section D

Athulin: /* Section D */

2012-01-19T12:19:31Z

‎Section D

Joachim Metz: /* Header */

2011-11-13T13:18:09Z

‎Header

Athulin: /* Section D */

2011-09-16T08:07:19Z

‎Section D

Athulin: /* Section D */

2011-09-16T08:04:27Z

‎Section D

Athulin: /* Section D */

2011-09-16T07:58:19Z

‎Section D

@@ Line 44: / Line 44: @@
 | 60
 | USTR
-| Name of executable as Unicode string, truncated after character 29 if necessary, and terminated by U+0000. As it appears in the prefetch file file name.
+| Name of executable as Unicode string, truncated after 29 code units, if necessary, and terminated by U+0000. As it appears in the prefetch file file name.
 |-
 | H6

@@ Line 148: / Line 148: @@
 == Section D ==
-Section D contains one or more sections. The number is (most likely) determined by the DWORD at file offset 0x0070. Each section refers to directories on an identified volume.
+Section D contains one or more subsections. The number is (most likely) determined by the DWORD at file offset 0x0070. Each subsection refers to directories on an identified volume.
-In this sections, all offsets are assumed to be counted from the start of the D section.
+In this section, all offsets are assumed to be counted from the start of the D section.
 {| class="wikitable"

@@ Line 148: / Line 148: @@
 == Section D ==
-Section D begins with one or more headers. The number is (most likely) determined by the DWORD at file offset 0x0070. Each header refers to directories on an identified volume.
+Section D contains one or more sections. The number is (most likely) determined by the DWORD at file offset 0x0070. Each section refers to directories on an identified volume.
 In this sections, all offsets are assumed to be counted from the start of the D section.
@@ Line 217: / Line 217: @@
-If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).
+If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one section in the D section. If multiple volumes are referenced by section C, section D will contain multiple sections.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file will have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).

@@ Line 188: / Line 188: @@
 | 4
 | DWORD
-| Offset to section DHS1
+| ? Offset to section DHS1
 |-
 | DH6
@@ Line 194: / Line 194: @@
 | 4
 | DWORD
-| Length of section DHS1 (in bytes)
+| ? Length of section DHS1 (in bytes)
 |-
 | DH7
@@ Line 200: / Line 200: @@
 | 4
 | DWORD
-| Offset to section DHS2
+| ? Offset to section DHS2
 |-
 | DH8
@@ Line 206: / Line 206: @@
 | 4
 | DWORD
-| Nr of strings in section DHS2
+| ? Nr of strings in section DHS2
 |-
 | ?
 | +0x0024
 | ?
-| ? additional 4 bytes
+| ?
 |}
 If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).

@@ Line 148: / Line 148: @@
 == Section D ==
-Section D begins with one or more headers. The number is (most likely) determined by the DWORD at file offset 0x0070. Each header refers to directories on a volume.
+Section D begins with one or more headers. The number is (most likely) determined by the DWORD at file offset 0x0070. Each header refers to directories on an identified volume.
 In this sections, all offsets are assumed to be counted from the start of the D section.
@@ Line 161: / Line 161: @@
 |-
 | DH1
-| 0x0000
+| +0x0000
 | 4
 | DWORD
@@ Line 167: / Line 167: @@
 |-
 | DH2
-| 0x0004
+| +0x0004
 | 4
 | DWORD
 | Length of volume string (nr of characters, including terminating U+0000)
 |}
 If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).

@@ Line 166: / Line 166: @@
 | Offset to volume string (Unicode, terminated by U+0000)
 |-
 |}
 If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers.  (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).

@@ Line 26: / Line 26: @@
 | 4
 | DWORD
-| ? Probably a file magic number. Only observed value: 0x41434353
+| ? Probably a file magic number. Only observed value: 0x41434353 ('SCCA')
 |-
 | H3

← Older revision		Revision as of 08:04, 16 September 2011
Line 167:		Line 167:
	\|-		\|-
	\|}		\|}
		+
		+	If all the executables and libraries referenced in the C section are from one single disk volume, there will be only one header in the D section. If multiple volumes are referenced by section C, section D will contain multiple headers. (A simple way to force this situation is to copy, say, NOTEPAD.EXE to a USB drive, and start it from that volume. The corresponding prefetch file with have one D header referring to, e.g. \DEVICE\HARDDISK1\DP(1)0-0+4 (the USB drive), and one to, e.g. \DEVICE\HARDDISKVOLUME1\ (where the .DLLs and other support files were found).