windows prefetch: proof apps ran, even after deletion

windows remembers more than you think

you delete a program thinking that's the end of it. the .exe is gone, the folder is gone, maybe you even emptied the recycle bin. but windows has been quietly keeping receipts this whole time in a folder most people never look at: prefetch. it's not spyware, it's not some hidden hacker tool, it's a performance feature that doubles as a forensic goldmine.

what prefetch actually is

windows wants apps to open fast. so every time you run a program, windows creates a small file that records which parts of that program get loaded and in what order. next time you launch it, windows uses that file to preload stuff into memory ahead of time, shaving fractions of a second off startup. that's it. that's the whole reason it exists. it's a speed trick, not a surveillance feature.

the side effect is that these files, ending in .pf, sit in C:\Windows\Prefetch and basically say "this program ran on this system." the file even survives after you uninstall or delete the program itself, because prefetch isn't tied to the program's files, it's tied to the fact that it executed.

the command, broken down

(dir C:\Windows\Prefetch\*.pf).Count

let's take this apart piece by piece:

dir C:\Windows\Prefetch\*.pf lists every file in that folder ending in .pf, which is the extension windows uses for prefetch records. the asterisk is a wildcard meaning "any filename, as long as it ends in .pf."

(...) wraps that listing so powershell treats it as one object instead of just printing it to the screen.

.Count tacked on the end tells powershell "don't show me the list, just tell me how many items are in it."

run the whole thing and you get a single number back: how many prefetch files exist on your machine right now. that number is basically a running tally of distinct executables that have launched on that system, going back a while, depending on how full the folder gets.

why this matters for defense

this is the same reason incident responders love prefetch. if a machine gets compromised, an attacker might run a malicious tool once, delete it, and think they covered their tracks. but the prefetch entry for that .exe often survives. so when you're checking a system you think might be compromised, prefetch is one of the first places to look, not just to count files but to see the actual filenames of what's run recently.

you can go further than just counting. this pulls the actual list with names and last-run info:

dir C:\Windows\Prefetch\*.pf | Select-Object Name, LastWriteTime

scan that list for anything you don't recognize. a random .exe from a temp folder, a tool you never installed, a filename that looks like it's trying to blend in. that's your lead. prefetch won't tell you what the program did, but it will tell you it existed and roughly when.

how to use this to protect your own system

make checking prefetch a normal part of your own hygiene, especially after you've clicked something sketchy, run a downloaded tool you're unsure about, or handed your laptop to someone else for "five minutes."

periodically run the count command as a baseline. if that number suddenly jumps way up, or if you spot filenames tied to remote access tools, cracked software, or random one-off .exe names you don't recognize, that's worth investigating further, not panicking over, just looking closer.

don't rely on deleting a suspicious file as your cleanup step. deleting the program does not erase the prefetch entry. if you're doing incident response on your own machine, treat prefetch as evidence to review, not something to worry about clearing, and definitely don't disable prefetch as a "privacy fix," you'll just be crippling your own boot speed for a feature that mainly helps you, the defender, understand what's touched your system.

the takeaway

prefetch exists to make your apps open faster, but it accidentally makes windows a decent witness. one line of powershell gives you a count, a couple more give you names and timestamps. use it the way defenders do: as a quick gut check on what's actually been running on a machine you're responsible for.