Technology and tools
What is Prefetch?
Windows files that speed up program launches and, as a side effect, record which programs ran, how often and when.
Prefetch files are created by Windows to speed up application start-up. Stored in C:\Windows\Prefetch, each file records an executable's name, a run count, the last several run times and files it loaded.
That makes prefetch one of the best forensic artefacts for proving that a program executed on a workstation, even if the program itself has since been deleted. It is disabled by default on many server editions of Windows.