Prefetch-Hash-Cracker - A Small Util To Brute-Force Prefetch Hashes

Motivation

During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created.

Using the tool

The following fields must be provided:

• Executable name
  Including the extension. It will be embedded in the prefetch filename, unless this happens.

• Prefetch hash
  8 hexadecimal digits at the end …

brute-force dfir forensics hash hashes prefetch