Demystifying Windows Prefetch (solving real world security problems: hacking and protection)

Abstract

The purpose of this project is to document the default behaviour of the Microsoft Windows Prefetecher and Superfetch components under the lens of digital forensics. This project covers the various limitations of the Windows Prefetecher which limits its reliability and capabilities as a forensic artifact. This paper will cover the default settings bundled with various Windows editions spanning Windows 10 and 11. Next, various configuration options for Prefetcher, Superfetch and the Sysmain Service are evaluated along with their effects on the creation and retention of prefetch files. Lastly, it covers the various test cases attempted to circumvent the Prefetcher component aiming to recreate techniques attackers may employ.