Windows Prefetch Forensic Analysis

This skill empowers security analysts and forensic investigators to automate the parsing of Windows Prefetch (.pf) files using the windowsprefetch Python library. It extracts critical metadata including execution timestamps, run counts, and loaded DLLs to provide a clear picture of system activity. By identifying suspicious patterns such as renamed binaries, first-time executions during an incident window, and the use of anti-forensics tools, this skill significantly accelerates the digital forensics and incident response (DFIR) process within Claude Code and other AI-driven development environments.

主要功能

使用场景