Prefetch File Recovery
This script is designed to find deleted prefetch files in both compressed and uncompressed formats.
Output is via bookmarks and a logical evidence file whose contents can be parsed using the Prefetch Dump (PFDump) EnScript.
Compressed prefetch files will be decompressed automatically as part of the validation/extraction process.
The script provides the option to exclude prefetch files above a certain size. The main purpose of this is to help validate hits relating to compressed prefetch files.
Feedback is provided via the console and status-bar.
This script was developed for use in EnCase training. For more details, please click the following link:
Download Now