Windows Prefetch Forensic Analysis

This skill provides a comprehensive framework for digital forensic investigators to parse and interpret Windows Prefetch (.pf) files. It enables AI agents to extract critical evidence such as application run counts, multiple execution timestamps (for Windows 8+), and lists of referenced files and directories. By automating the identification of suspicious binaries like credential dumpers, remote access tools, and anti-forensic utilities, this skill helps incident responders build accurate attack timelines and verify malicious activity across various Windows versions, including handling modern MAM-compressed formats.

主要功能

使用场景