This parser supports all known versions from Windows XP to Windows 10. Any digital forensic investigator or analyst has already known, that prefetch-file format in Windows 10 changed. The new tool from Eric Zimmerman helps to solve the problem – parse prefetch version 30. Make sure you have at least Windows 8 before running this code.
The code can be downloaded here.
DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.
