Forensic Analysis of Windows 11 Prefetch Artifact

The Operating System creates numerous objects to improve its efficiency and user experience and such objects are called artifacts. These artifacts record crucial data about the user activity. Such artifacts are the start point of any investigation as they can be an additional lead to a forensic triage. Prefetch file is one among various objects, presence of which confirms the execution of a particular application. Prefetch gives additional inside for the purpose of investigation. Thus, this paper brings out the forensic value of it, the tools required to decode the information it contains and also look in various caveats in interpreting this artifact to learn its strength and weaknesses to properly incorporate in support of opinion derived by the analyst. In this work, Prefetch is forensically examined to bring out its forensic value, knowledge it contains and all of that in whole or in parts can be used to help advance in investigation. Paper also brings out the difference in format of this artifact among various version of Windows OS.