Monday, February 9, 2009

Updated Prefetch Parser......

I have updated the prefetch parser so it will now read all the prefetch files in a directory. It will produce a main report that will show each prefetch file, the actual file name, the number of times run and the embedded date/time. You can also click on the prefetch file name and see the dll/files that were loaded when the program was run. This will work for XP, 2003 and Vista. The new program can be found here. I have left the old program out there as well in case you still want to parse a single file.

As always Questions/Comments/Thoughts?

36 comments:

Anonymous said...

Thanks for the tool. I have a homework assignment that this will come in extremely handy for.

A said...

I like the idea off this tool, but when I run it on my Vista box, after running for 2% I get a pop-up saying "Cannot find the file index.html. Fill in the name again and try again.
I have no way where I can fill in this name.
Can you help me,
TIA
best regards
Anton Verzijl
The Hague Police
Netherlands
anton@digitale-expertise.nl

Mark McKinnon said...

One thing to make sure is that you are running the program with admin rights, otherwise you will not be able to see the prefetch files.

carpemundi said...

Your tool asks for an INDEX.HTML file on my system, and when it doesn't find it, it searches the current PATH variable. Do you use such a file to build your report?

Mark McKinnon said...

It should create the index.html file in the diretory where you tell it to write the reports. If it cannot find it then the index.html was not created. Usually this means the program had an error. Do you have admin rights on the box where you are running the program. I have seen then cause a problem if you do not have admin rights. If you are still getting this error then send me an email at mark dot mckinnon at redwolfcomputerforensics dot com and I can try and help you out.

Kind regards.

Mark

Anonymous said...

Nice improvement. I notice that when I run the tool on Vista the number of times run for the prefetch files listed is 0 (zero) and there is no path from where the file was run from.

Thanks,

Anonymous said...

Hello,

Quick question: Below is your comment about dll/files that were loaded ....
"see the dll/files that were loaded when the program was run."

Do you mean the dll/files that were loaded by the program that was run, or by other programs that had previouly run?
Thanks

Hans said...

About the problem with the index.html not loading, I figured out that all goes wel when the exported data is saved into the same directory as the program directory. If one chooses an other export directory, the index.html will not be loaded. The program looks for the index.html in to the program directory.

Kind regards from the Netherlands

Hans

Baker said...

Why does it not work with windows 7? what windows 7 have or havent that makes it incompatible or prevents it from working properly?

Mark McKinnon said...

I have not tested it with Windows 7 so I am not sure if it does not work or not. I will put it on my list of things to do and verify it does or does not work and repost my results.

Mark

Chee Siong said...

About your comment that "see the dll/files that were loaded when the program was run."

Do you mean the dll/files that were loaded by the program when it was run or what does it show?

Thanks

Anonymous said...

we provide a wow gold or wow power leveling and wow gold

mygamebest said...

Very nice! Aion Gold You guys know what buy wow gold you're doing in wow power leveling designing Allods Gold these Allods Gold health status ffxi gil dashboards. Glad EQ2 Gold to see Lotro Gold your taking maple story mesos transparency seriously, and recognizing ROM Gold the benefits of opening eve isk up to your users. It will be an interest case study Lineage 2 adena to see how the (inevitable) next downtime event compares to the swg Credits previous one now that this exists.

Anonymous said...

Hola! Nina Jonson . payday loans

said...

姫野愛MUTEKI吉野公佳鈴木早智子エロ動画YouTubeえろつべSEXエロ動画アダルトロリータMUTEKIおっぱいアダルトS1ニコニコ動画youtubeveohエロ動画ようつべエロ動画えろつべエロ動画SEXゆーちゅーぶ

東京ほっとアダルトH動画エロ動画JK・JCyoutubeエロ動画熟女ニコ動画S1エスワン無修正AV動画エロ動画ユーチューブYouTubeようつべAV無料パイパン近親相姦レイプ強姦中出し二宮沙樹パイズリ明日花キララ

said...

オーラルセックス手こきパイパンイラマチオパイズリパイズリみひろ蒼井そら穂花原紗央莉小澤マリア初音みのりRio(柚木ティナ)秋元美由北条麻妃妃乃ひかりかすみ果穂天海つばさ藤浦めぐAV女優アダルトエロ動画JKアダルトまんこ

人妻奥様熟女熟女アダルト エロ動画マダムパンチラアダルトフェラフェラパイズリ手こき手こき痴女熟女熟女熟女熟女美脚美尻巨乳熟女巨乳

Anonymous said...

Generic Viagra is an effective treatment for male erectile dysfunction, or ED. This is also known as impotence. Generic Viagra online is a little blue pill you take only when you want to have sex. Generic Generic Cialis helps men consistently get and keep an erection when they become sexually stimulated.

Anonymous said...

Generic Viagra is an effective treatment for male erectile dysfunction, or ED. This is also known as impotence. Generic Viagra online is a little blue pill you take only when you want to have sex. Generic Generic Cialis helps men consistently get and keep an erection when they become sexually stimulated.

costa rica vacation said...

hello friends! that good information is obtained in places like this, thank you all for making this a reality

sister said...

Such kind of articl is our need , it can give us help from different aspect for different people . after reading this article , I learn a mount of knowkedge increase my power , my families and I all like you article ,reading you article is our best love. May be you are Sports fans? Do you like NFL jerseys or Puma Shoes , Ecco shoes , Nike Sneakers ,these have the high quality,low price,professional service,Just For You if you like.Thank you again for writing this article!

boshi said...

The main purpose is to keep your nature energy balance, and make you fell relax, and the fun of sport.
power balance,and some special ones,
the Phiten Necklace.We feel confident that once you had tried our products, you will be completely satisfied with them.power balance

wyuguy said...

power led
wifi range extender

generic Ceclor said...

Really great post, Thank you for sharing This knowledge.

Generic Viagra said...

Nice post, I would like to request you to one more post about that Keep it up

Penis Enlargement Pills said...

The article is worth while reading, I like it very much and which you shared the info in this post is very useful. Thanks for sharing a wonderful post.

Buy Soma Online said...

Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!

Buy Misoprostol | Buy Biltricide | Buy Darvocet |

Iyan said...

Awesome, this is the tool i have been searching for. I need this for forensic purpose. Thanks a lot!

Generic Drugs Exporter said...

I have wanted to learn more about particular topics, but not many websites would help me out in informing me the way I expected. This left me with many question, but after reading your article, I got an answer to all my questions. You are too cool dude!!!

Anonymous said...

アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト

xanax online said...

Really you have done great job,There are may person searching about that now they will find enough resources by your post.I like this blog.

Online Pharmacy said...

Very interesting discussion glad that I came across such informative post. Keep up the good work friend. Glad to be part of your net community.

runescape-powerlevel said...

Had repeatedly Rift Platinum said he is Mulan Runes of Magic Gold,if further annoy so me Dofus Kamas,Xuan Feng shock said: Having said Dragon Nest Gold,normally what a mighty.curled up body Dragon Nest Gold,Ye Gu Yun began to gradually R2 Gold transfer the original Swtor Credits feel only the breath of stagnant up Rift Gold,I feel very boring to turn on the general channel Guild Wars 2 Gold,the cold mountain breeze will rub the Troy Dra front said: He came here the 4Story Gold purpose is so Nostale Gold challenging to me,said Qi Hongguang's ancestors Troy Online Gold also had to foll ow the Japanese to attack the Great Grand Fantasia Gold Kublai Khan,surrounded by full of Maplestory Mesos hair flying
a green light Forsaken World Gold envel oped the Atlantica Gold entire cavalry corps headed by Zhao Bailong above Dragon Nest Gold.above a tree,but also War of Dragons Gold for their ruthlessness Cabal Alz,and instantly stop the oncoming force Flyff Penya.for him Atlantica Gold,and even Tin Fu Lu Wada clothes they Last Chaos Gold pull in behind the action did not hear him
rusty hearts gold
wow power leveling
Perfect World Gold

www.lamparas.biz said...

Thanks for this post, pretty effective piece of writing.

pay per head said...

I'll be visiting your site again to gather some more valuable information. You truly did a good job.

small business voip said...

I Like your blog,will sharing this with my friends, excellent work.
small business voip

furniture jati said...

article from a very amazing, Good Job, Thank you for presenting a wide variety of information that is very interesting to see in this artikle


wisata karimunjawa
and jual furniture
or jepara furniture
and toko tenun