Monday, February 9, 2009

Updated Prefetch Parser......

I have updated the prefetch parser so it will now read all the prefetch files in a directory. It will produce a main report that will show each prefetch file, the actual file name, the number of times run and the embedded date/time. You can also click on the prefetch file name and see the dll/files that were loaded when the program was run. This will work for XP, 2003 and Vista. The new program can be found here. I have left the old program out there as well in case you still want to parse a single file.

As always Questions/Comments/Thoughts?

41 comments:

Anonymous said...

Thanks for the tool. I have a homework assignment that this will come in extremely handy for.

AntonsPlace said...

I like the idea off this tool, but when I run it on my Vista box, after running for 2% I get a pop-up saying "Cannot find the file index.html. Fill in the name again and try again.
I have no way where I can fill in this name.
Can you help me,
TIA
best regards
Anton Verzijl
The Hague Police
Netherlands
anton@digitale-expertise.nl

Mark McKinnon said...

One thing to make sure is that you are running the program with admin rights, otherwise you will not be able to see the prefetch files.

carpemundi said...

Your tool asks for an INDEX.HTML file on my system, and when it doesn't find it, it searches the current PATH variable. Do you use such a file to build your report?

Mark McKinnon said...

It should create the index.html file in the diretory where you tell it to write the reports. If it cannot find it then the index.html was not created. Usually this means the program had an error. Do you have admin rights on the box where you are running the program. I have seen then cause a problem if you do not have admin rights. If you are still getting this error then send me an email at mark dot mckinnon at redwolfcomputerforensics dot com and I can try and help you out.

Kind regards.

Mark

Anonymous said...

Nice improvement. I notice that when I run the tool on Vista the number of times run for the prefetch files listed is 0 (zero) and there is no path from where the file was run from.

Thanks,

Anonymous said...

Hello,

Quick question: Below is your comment about dll/files that were loaded ....
"see the dll/files that were loaded when the program was run."

Do you mean the dll/files that were loaded by the program that was run, or by other programs that had previouly run?
Thanks

Hans said...

About the problem with the index.html not loading, I figured out that all goes wel when the exported data is saved into the same directory as the program directory. If one chooses an other export directory, the index.html will not be loaded. The program looks for the index.html in to the program directory.

Kind regards from the Netherlands

Hans

Baker said...

Why does it not work with windows 7? what windows 7 have or havent that makes it incompatible or prevents it from working properly?

Mark McKinnon said...

I have not tested it with Windows 7 so I am not sure if it does not work or not. I will put it on my list of things to do and verify it does or does not work and repost my results.

Mark

Unknown said...

About your comment that "see the dll/files that were loaded when the program was run."

Do you mean the dll/files that were loaded by the program when it was run or what does it show?

Thanks

Anonymous said...

Hola! Nina Jonson . payday loans

Anonymous said...

Generic Viagra is an effective treatment for male erectile dysfunction, or ED. This is also known as impotence. Generic Viagra online is a little blue pill you take only when you want to have sex. Generic Generic Cialis helps men consistently get and keep an erection when they become sexually stimulated.

costa rica vacation said...

hello friends! that good information is obtained in places like this, thank you all for making this a reality

Anonymous said...

The main purpose is to keep your nature energy balance, and make you fell relax, and the fun of sport.
power balance,and some special ones,
the Phiten Necklace.We feel confident that once you had tried our products, you will be completely satisfied with them.power balance

wyuguy said...

power led
wifi range extender

generic Ceclor said...

Really great post, Thank you for sharing This knowledge.

Generic Viagra said...

Nice post, I would like to request you to one more post about that Keep it up

Penis Enlargement Pills said...

The article is worth while reading, I like it very much and which you shared the info in this post is very useful. Thanks for sharing a wonderful post.

Buy Soma Online said...

Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!

Buy Misoprostol | Buy Biltricide | Buy Darvocet |

Iyan said...

Awesome, this is the tool i have been searching for. I need this for forensic purpose. Thanks a lot!

Generic Drugs Exporter said...

I have wanted to learn more about particular topics, but not many websites would help me out in informing me the way I expected. This left me with many question, but after reading your article, I got an answer to all my questions. You are too cool dude!!!

Anonymous said...

アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト
アダルト

xanax online said...

Really you have done great job,There are may person searching about that now they will find enough resources by your post.I like this blog.

Online Pharmacy said...

Very interesting discussion glad that I came across such informative post. Keep up the good work friend. Glad to be part of your net community.

www.lamparas.biz said...

Thanks for this post, pretty effective piece of writing.

pay per head said...

I'll be visiting your site again to gather some more valuable information. You truly did a good job.

furniture jati said...

article from a very amazing, Good Job, Thank you for presenting a wide variety of information that is very interesting to see in this artikle


wisata karimunjawa
and jual furniture
or jepara furniture
and toko tenun

High School Diploma Program said...

thanks for sharing awesome work

Anonymous said...

Hello, just wanted to say, I loved this article. It was practical.
Keep on posting!
Visit: games2girls | kids games online | juegosjuegos.com | juegos de matar zombies | jogos do friv

juegoskizi said...

I like the idea off this tool
----
juegos kizi | juegos de kizi | juegoskizi

Unknown said...

HI, is this parser no longer available? I saw the website is no longer in service and i was unable to find the zip file on your github. trying to use this for school research.
Thanks

hrroman said...


If you are stuck with your Law assignment then in this case you can opt for our Law Assignment Help. we provide the bestLaw assignment writing UK.We also provideLaw Assignment and Essay Writing Help UK for students across the globe. for more information contact us +16692714848.

Sarah said...

Save more than 50% of your monthly phone bills by switching to business VoIP systems from Menetalk. We are the best business voip providers uk

Kova Lucas said...

Are you looking for the easiest and quickest way how to make Windows 10 faster? Have you experienced one of the following when you use your laptop?

Computer not responding or running slower than usual?
Does it take forever to run or load programs?
Your laptop freezes up or crashes at random?
You are plagued by the Blue Screen of Death?
Computer errors frequently pop up and hassle you?
Your system takes forever to boot up or shut down?


Worry no more because a registry cleaner software should be able to diagnose what's the problem and lets you pinpoint exactly how to boost system performance on your laptop. Don't try to fix it manually as it is only recommended for computer experts. It's because if you remove or uninstall a wrong registry entry, your laptop may entirely collapse.

It's highly recommended to use a registry clean up software at this point. You can get a free diagnosis for common computer/laptop issues like:


Computer Freezing
Error Messages
Blue Screens
Spyware and Viruses
Update Drivers
Slow Speeds


Let a registry cleaner automatically scan your computer and improve the speed of your laptop in minutes!

RSM Enterprises said...

RSM Enterprises are trusted for manufacturing, exporting and supplying of Sildenafil citrate 250mg (Sildigra 250mg).

Email : sales@rsmenterprises.in
Chat on WhatsApp with +91 92163-25377

Sildenafil 100mg Tablet
Sildigra 250mg
Buy Sildigra 250mg (Sildenafil)

Anonymous said...

Chat privately with your team amidst a conference call with the leading business VoIP providers UK - Menetalk!!!

NJM said...

We NJM - emergency locksmiths Northampton are here to offer you quality locksmith services in Northampton.

Onlinepillsrx said...

Thanks for sharing your blog with us.
[url=http://www.onlinepillsrx.co/Men-Health/Buy-Lovegra-Online]
Buy Lovegra 100mg[/url] It works by increasing the blood flow in the vaginal area. Lovegra increases libido and even restores the lack of sex drive.

Western Digital Data Recovery Mac said...

Do you use a Western Digital hard drive or other external storage product from this provider? A recent reformat, file removal, or other complication from your WD drive is not as big of a catastrophe as most individuals would initially think.

Go here to learn how to recover files from Western Digital: http://www.macdatarecoveryhq.com/western-digital-data-recovery-mac/

Buystrip said...

Sildigra 250 is a high-strength medication formulated to address erectile dysfunction in men. Buy Sildigra 250mg Tablets Same Day Shipping.
Order Now >>> Click Here