Prefetcher Setting
Whether the Prefetcher is on, which decides if new execution evidence is written.
Use it to tell whether Prefetch evidence was still being created, and spot it switched off.
- SYSTEM
- Defence Evasion
What It Is
The Prefetcher is a Windows feature that speeds up start-up and program launches by loading the data they need into memory before it is asked for. It saves what it learns about each start in data files, so the next start can load that data early. EnablePrefetcher, in the PrefetchParameters key of the SYSTEM hive, sets what it covers, where 0 is off, 1 is program launches, 2 is boot and 3 is both.
What It Proves
EnablePrefetcher controls whether Windows writes the .pf files that record program execution. Set to 0, no new prefetch files are created, so execution evidence after that point is lost.
What It Does Not Prove
It affects new files only, and existing .pf files remain. Servers and some SSD setups ship with prefetch reduced or off, so read the value against the host type.
Where It Lives
Prefetcher Setting lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| EnablePrefetcher holds the workstation default, 3, so Windows writes a .pf file for programs as they run. Look for a PSEXEC |
| Prefetch is off, so no new .pf files are written. If this changed mid-incident, execution evidence stops there, so parse existing files and note the gap. |
How to Read It
Read EnablePrefetcher under Session Manager\Memory Management\PrefetchParameters. 3 is application and boot prefetch (the workstation default), 0 is off. To restore the evidence source, set it back to 3. Existing .pf files are still worth parsing.
- When Windows Writes It
- It is written when an administrator or an attacker with admin rights changes the value. It takes effect at the next boot.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, PECmd (for the .pf files)
Hunt It
Defender is not known to record this key. Read it with Velociraptor, or collect the SYSTEM hive and parse it.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmdPECmd (for the .pf files)
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Prefetcher Setting shows.
Sources
The facts on this page come from these public pages, which say more on each point.