Install

Prefetch Parser runs from source on Windows, Linux and macOS. A pre-built bundle that needs no Python installation is available for Linux x86-64.

From source

Requires Python 3.10 or newer. The command line and the parsing library use only the standard library; only the GUI needs an extra package.

$ git clone https://github.com/Mihir-Choudhary/Prefetch-Parser.git$ cd Prefetch-Parser$ pip install PySide6

Skip pip install PySide6 if you only need the command line. Then check that it runs:

$ python -m pfcli capabilities$ python -m pfgui

capabilities lists the decompressors available on this machine: ntdll on Windows, and the built-in pure decoder everywhere.

Linux bundle

The v0.9.0 release includes prefetch-explorer-v0.9.0-linux-x86_64.tar.gz: the command line and the GUI in one directory, with no Python installation required. Verify the checksum before use:

$ sha256sum -c SHA256SUMS.txt$ tar -xzf prefetch-explorer-v0.9.0-linux-x86_64.tar.gz$ ./prefetch-explorer/pfcli parse /path/to/Prefetch --db case.db --csv case.csv

The bundle carries the licences of everything it embeds in prefetch-explorer/licenses/. Qt 6 and PySide6 are LGPL-3 and ship as replaceable shared objects.

Note:

There is no pre-built Windows or macOS build yet. On those systems, run from source.

Working from a copy

Reading a folder in place updates its access times. Prefetch Parser reads each file’s timestamps before opening it, so the reported access time is never its own read, and it never writes to the evidence folder. Working from a copy of the Prefetch folder is still recommended.