Prefetch Analyzer Lite
Inspect Windows Prefetch execution artifacts locally to recover run counts, timestamps and referenced paths.
Prefetch Analyzer Lite is a browser-based triage tool for extracting execution metadata from Windows `.pf` artifacts without uploading them.
This Lite parser focuses on common format versions, recent run times, path recovery and suspicious execution clues rather than full forensic reconstruction.
Prefetch input
Lite mode extracts execution metadata, recent run times and referenced paths from local `.pf` files.
Drop a local Windows Prefetch file here or click to browse
Accepted: .pf
No Prefetch file selected
Upload a local `.pf` file to inspect execution details, run counts and referenced paths in Lite mode.
Frequently Asked Questions
Are files uploaded to a server?
No. All parsing and analysis runs entirely in your browser. No files are uploaded to any external server.
What file formats does this tool accept?
Typical supported formats: .pf, .pfb, prefetch. If your format is not listed, try exporting or providing a compatible file.
Can I analyze large files?
Large files may be slow or memory-intensive in the browser. For very large datasets consider using a local specialist tool.
Which prefetch versions are supported?
The Lite parser focuses on common Windows Prefetch formats and recent versions; some legacy or corrupted files may not parse completely in-browser.
Does the tool upload my data?
No. All parsing and analysis runs locally in your browser; nothing is sent to external servers.
Can I get execution counts and referenced paths?
Yes. The tool extracts run counts, last run time and referenced file paths where available, but it is not a full forensic reconstructor.