disk_parse_prefetch
Parse Windows Prefetch files to reveal executed programs, run counts, and last run times from a single .pf file or entire Prefetch directory.
Instructions
Parse Windows Prefetch files to determine program execution history, run counts, and last execution times. Can parse a single .pf file or an entire Prefetch directory. Supports pagination.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to .pf file or Prefetch directory | |
| limit | No | Maximum number of prefetch entries to return (default 20) | |
| offset | No | Skip first N entries for pagination | |
| executable_filter | No | Filter by executable name (case-insensitive substring). Only applies to directory parsing. | |
| include_loaded_files | No | Include list of files/DLLs loaded by the executable (WARNING: increases output size significantly) |