Guide · Agent skill
How to use the Prefetch Execution History Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-prefetch-files-for-execution-history agent skill, which teaches an AI agent to read Windows Prefetch files and report which programs ran, when, and what files they touched. It is aimed at digital forensics and incident response analysts working from a Windows disk image, though anyone with a copy of the files can follow it. By the end you will know how to install the skill, ask for the analysis in plain language, and understand what the agent produces and where it can fall short.
Prefetch Execution History Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- 4Gather the Prefetch files. Copy the .pf files from C:\Windows\Prefetch\ in your forensic image to a case folder, read-only.
- 5Ask for the analysis. Describe the task in plain language, such as checking whether a suspicious binary ran.
- 6Review and cross-check. Confirm the agent's timestamps and run counts against Shimcache, Amcache, or other artifacts.
What the skill makes the agent do
Windows Prefetch files are small cache files that Windows creates to speed up program launches. They also record evidence that a program ran. The skill guides the agent through copying these files from a forensic disk image, hashing them for integrity, and parsing them with PECmd or Python.
The agent reports run counts, last-run timestamps, and referenced files and DLLs. It also searches file names for common attack or remote-access tools to help build a timeline of execution during an incident.
Install the skill
Download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder for use in one project only.
Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
Prepare the tools and files it needs
The skill works from files, so you need Windows Prefetch files from a forensic image, taken from the C:\Windows\Prefetch\ directory. You also need one of the parsers: PECmd by Eric Zimmerman, WinPrefetchView, or the python-prefetch package. Python 3 is needed for the bundled script. On Linux, Mono or Wine is optional for running PECmd.
- Windows Prefetch files from a forensic image
- PECmd (Eric Zimmerman), WinPrefetchView, or python-prefetch
- Python 3 for the bundled script
- Optional: Mono or Wine to run PECmd on Linux
Trigger the skill with natural requests
You do not need special syntax. Describe the investigation task in plain words and the agent should pick up the skill when your request matches its purpose, such as building a timeline of program execution, confirming whether a suspicious binary ran, or correlating execution evidence with other artifacts.
- Build a timeline of which programs ran on this Windows image using the Prefetch files.
- Did powershell.exe or rundll32.exe run on this system? Check the Prefetch evidence.
- Show run counts and last-run times for the Prefetch files in this case folder.
- Correlate Prefetch execution evidence with the Amcache and Shimcache entries I have.
Work through a typical analysis
The skill's workflow starts by mounting the forensic image read-only and copying the .pf files to a case folder, then hashing them with SHA-256. Prefetch filenames follow the pattern EXECUTABLE_NAME-XXXXXXXX.pf, where the hash part is based on the executable path, so the same program run from different paths produces different files.
Next, parse the files with PECmd, which can output CSV or JSON, or use the Python approach for Linux-based analysis. The Python code handles uncompressed files only; Windows 10 files in compressed MAM format need PECmd. Finally, search file names for known tool names and build a timeline from the timestamps.
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence
mkdir -p /cases/case-2024-001/prefetch/
cp /mnt/evidence/Windows/Prefetch/*.pf /cases/case-2024-001/prefetch/
sha256sum /cases/case-2024-001/prefetch/*.pf > /cases/case-2024-001/prefetch/pf_hashes.txtCheck the limits before you rely on the results
The skill does not verify chain of custody on its own, so keep the forensic copy preserved and documented. It is not meant for live systems. Windows Server systems have Prefetch disabled by default, so the files may be absent there.
Prefetch existence shows that a program ran at least once, and the skill's guidance suggests cross-referencing with Shimcache and Amcache for confirmation. Treat the output as one piece of evidence, not a final answer.
- Not for live systems or cases where the forensic copy has not been preserved.
- Not for Windows Server systems, where Prefetch is disabled by default.
- Windows 10 and later compressed MAM files need PECmd, not the bundled Python code.
What people use it for
- Building a timeline of which programs ran on a Windows disk image during an incident.
- Confirming whether a suspicious binary such as a remote-access tool actually executed.
- Listing run counts and last-run times for programs found in a case folder.
- Correlating Prefetch execution evidence with other forensic artifacts like Amcache or Shimcache.
Frequently asked questions
How do I install the prefetch analysis agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.
What do I need to run it?
You need Windows Prefetch files from a forensic image, plus PECmd, WinPrefetchView, or the python-prefetch package. Python 3 is required for the bundled script, and Mono or Wine is optional for running PECmd on Linux.
Is the skill free to use?
The skill is licensed under Apache-2.0. This page does not list pricing, so check the licence file included with the skill for its terms.
Does it work on Windows 10 and 11 files?
Windows 10 and later files use a compressed MAM format that the bundled Python code cannot fully decode. Use PECmd for those files.
Why are there no Prefetch files on my server?
Prefetch is disabled by default on Windows Server systems, so the files may be absent. The skill is not designed for that case.
Does the skill prove a program ran?
Prefetch existence shows a program ran at least once, but the skill does not verify chain of custody. Cross-reference results with Shimcache and Amcache before drawing conclusions.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits DFIR analysts who have a preserved Windows disk image and need a structured way to pull execution history from Prefetch. It is not suitable for live systems, Windows Server, or anyone who cannot get PECmd or the Python parser working for compressed Windows 10 and 11 files.
Download the skill