I have updated the prefetch parser so it will now read all the prefetch files in a directory. It will produce a main report that will show each prefetch file, the actual file name, the number of times run and the embedded date/time. You can also click on the prefetch file name and see the dll/files that were loaded when the program was run. This will work for XP, 2003 and Vista. The new program can be found here. I have left the old program out there as well in case you still want to parse a single file.
As always Questions/Comments/Thoughts?
Monday, February 9, 2009
Updated Prefetch Parser......
Subscribe to:
Post Comments (Atom)
40 comments:
Thanks for the tool. I have a homework assignment that this will come in extremely handy for.
I like the idea off this tool, but when I run it on my Vista box, after running for 2% I get a pop-up saying "Cannot find the file index.html. Fill in the name again and try again.
I have no way where I can fill in this name.
Can you help me,
TIA
best regards
Anton Verzijl
The Hague Police
Netherlands
anton@digitale-expertise.nl
One thing to make sure is that you are running the program with admin rights, otherwise you will not be able to see the prefetch files.
Your tool asks for an INDEX.HTML file on my system, and when it doesn't find it, it searches the current PATH variable. Do you use such a file to build your report?
It should create the index.html file in the diretory where you tell it to write the reports. If it cannot find it then the index.html was not created. Usually this means the program had an error. Do you have admin rights on the box where you are running the program. I have seen then cause a problem if you do not have admin rights. If you are still getting this error then send me an email at mark dot mckinnon at redwolfcomputerforensics dot com and I can try and help you out.
Kind regards.
Mark
Nice improvement. I notice that when I run the tool on Vista the number of times run for the prefetch files listed is 0 (zero) and there is no path from where the file was run from.
Thanks,
Hello,
Quick question: Below is your comment about dll/files that were loaded ....
"see the dll/files that were loaded when the program was run."
Do you mean the dll/files that were loaded by the program that was run, or by other programs that had previouly run?
Thanks
About the problem with the index.html not loading, I figured out that all goes wel when the exported data is saved into the same directory as the program directory. If one chooses an other export directory, the index.html will not be loaded. The program looks for the index.html in to the program directory.
Kind regards from the Netherlands
Hans
Why does it not work with windows 7? what windows 7 have or havent that makes it incompatible or prevents it from working properly?
I have not tested it with Windows 7 so I am not sure if it does not work or not. I will put it on my list of things to do and verify it does or does not work and repost my results.
Mark
About your comment that "see the dll/files that were loaded when the program was run."
Do you mean the dll/files that were loaded by the program when it was run or what does it show?
Thanks
Hola! Nina Jonson . payday loans
Generic Viagra is an effective treatment for male erectile dysfunction, or ED. This is also known as impotence. Generic Viagra online is a little blue pill you take only when you want to have sex. Generic Generic Cialis helps men consistently get and keep an erection when they become sexually stimulated.
hello friends! that good information is obtained in places like this, thank you all for making this a reality
The main purpose is to keep your nature energy balance, and make you fell relax, and the fun of sport.
power balance,and some special ones,
the Phiten Necklace.We feel confident that once you had tried our products, you will be completely satisfied with them.power balance
power led
wifi range extender
Really great post, Thank you for sharing This knowledge.
Nice post, I would like to request you to one more post about that Keep it up
The article is worth while reading, I like it very much and which you shared the info in this post is very useful. Thanks for sharing a wonderful post.
Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!
Buy Misoprostol | Buy Biltricide | Buy Darvocet |
Awesome, this is the tool i have been searching for. I need this for forensic purpose. Thanks a lot!
I have wanted to learn more about particular topics, but not many websites would help me out in informing me the way I expected. This left me with many question, but after reading your article, I got an answer to all my questions. You are too cool dude!!!
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
Really you have done great job,There are may person searching about that now they will find enough resources by your post.I like this blog.
Very interesting discussion glad that I came across such informative post. Keep up the good work friend. Glad to be part of your net community.
Thanks for this post, pretty effective piece of writing.
I'll be visiting your site again to gather some more valuable information. You truly did a good job.
article from a very amazing, Good Job, Thank you for presenting a wide variety of information that is very interesting to see in this artikle
wisata karimunjawa
and jual furniture
or jepara furniture
and toko tenun
thanks for sharing awesome work
Hello, just wanted to say, I loved this article. It was practical.
Keep on posting!
Visit: games2girls | kids games online | juegosjuegos.com | juegos de matar zombies | jogos do friv
I like the idea off this tool
----
juegos kizi | juegos de kizi | juegoskizi
HI, is this parser no longer available? I saw the website is no longer in service and i was unable to find the zip file on your github. trying to use this for school research.
Thanks
If you are stuck with your Law assignment then in this case you can opt for our Law Assignment Help. we provide the bestLaw assignment writing UK.We also provideLaw Assignment and Essay Writing Help UK for students across the globe. for more information contact us +16692714848.
Save more than 50% of your monthly phone bills by switching to business VoIP systems from Menetalk. We are the best business voip providers uk
Are you looking for the easiest and quickest way how to make Windows 10 faster? Have you experienced one of the following when you use your laptop?
Computer not responding or running slower than usual?
Does it take forever to run or load programs?
Your laptop freezes up or crashes at random?
You are plagued by the Blue Screen of Death?
Computer errors frequently pop up and hassle you?
Your system takes forever to boot up or shut down?
Worry no more because a registry cleaner software should be able to diagnose what's the problem and lets you pinpoint exactly how to boost system performance on your laptop. Don't try to fix it manually as it is only recommended for computer experts. It's because if you remove or uninstall a wrong registry entry, your laptop may entirely collapse.
It's highly recommended to use a registry clean up software at this point. You can get a free diagnosis for common computer/laptop issues like:
Computer Freezing
Error Messages
Blue Screens
Spyware and Viruses
Update Drivers
Slow Speeds
Let a registry cleaner automatically scan your computer and improve the speed of your laptop in minutes!
RSM Enterprises are trusted for manufacturing, exporting and supplying of Sildenafil citrate 250mg (Sildigra 250mg).
Email : sales@rsmenterprises.in
Chat on WhatsApp with +91 92163-25377
Sildenafil 100mg Tablet
Sildigra 250mg
Buy Sildigra 250mg (Sildenafil)
Chat privately with your team amidst a conference call with the leading business VoIP providers UK - Menetalk!!!
We NJM - emergency locksmiths Northampton are here to offer you quality locksmith services in Northampton.
Thanks for sharing your blog with us.
[url=http://www.onlinepillsrx.co/Men-Health/Buy-Lovegra-Online]
Buy Lovegra 100mg[/url] It works by increasing the blood flow in the vaginal area. Lovegra increases libido and even restores the lack of sex drive.
Do you use a Western Digital hard drive or other external storage product from this provider? A recent reformat, file removal, or other complication from your WD drive is not as big of a catastrophe as most individuals would initially think.
Go here to learn how to recover files from Western Digital: http://www.macdatarecoveryhq.com/western-digital-data-recovery-mac/
Post a Comment