prefetch proves the file was opened, three times
PECmd.exe -f C:\Windows\Prefetch\INVOICE.EXE-A1B2C3D4.pfthe file that "never got opened" ran three times
this one comes up more than you'd think. someone clicks a bad attachment, the malware does its thing, and later, when asked about it, the answer is always the same: "i never opened that." cool story. windows disagrees, and windows keeps receipts.
the receipt in question is called prefetch, and it's not even a security feature. it was built for speed, not surveillance, which is exactly why it's such a good witness. it just so happens that "making programs launch faster" requires windows to log a bunch of details about every program that launches. defenders get to use that for free.
what prefetch actually is
every time you run an executable, windows creates or updates a small file in C:\Windows\Prefetch named after that program, with a hash of its path tacked on the end. something like INVOICE.EXE-A1B2C3D4.pf. that file caches info about what the program needs to load, so next time it opens faster.
the side effect is that this .pf file becomes a tiny logbook. it tracks how many times that exact program has run, the last time it ran, and (going back further on some systems) a handful of earlier run timestamps too. it also tracks which folders were referenced during execution, which is how you find out something launched from Downloads instead of, say, Program Files, which is a pretty big tell on its own.
pulling the file apart
first, see what's actually sitting in that folder:
dir C:\Windows\Prefetch\*.pfyou'll get a list of .pf files, one per executable that's run on that machine (windows keeps a limited number, older ones roll off, but recent activity is almost always there). find the one tied to your suspicious file and parse it with a proper tool, since these files are binary and not meant to be read by eyeballs. eric zimmerman's PECmd is the standard here:
PECmd.exe -f C:\Windows\Prefetch\INVOICE.EXE-A1B2C3D4.pfreading the output
the report hands you the stuff that actually matters:
executable name: confirms exactly what ran, INVOICE.EXE in this case, matched to the hash in the filename so you know it's the right one and not a coincidence.
run count: this is the number that ends the argument. zero means it never executed. three means it executed three times. there's no ambiguity here, this counter doesn't increment on its own and it doesn't lie because someone felt embarrassed.
last run timestamp: down to the second. line this up with email logs, browser download history, or edr alerts and you get a clean timeline of exactly when the click happened.
directory strings: prefetch records the folders referenced during that run, which is how you learn the file executed straight out of Downloads or Temp, the two folders that show up in almost every "how did this get on my machine" conversation.
why this matters more than someone's memory
people misremember things, get embarrassed, or just genuinely don't realize they clicked something. none of that changes what's sitting in the prefetch folder. it's a small, boring, mechanical log that doesn't have an opinion, and that's exactly what makes it useful during an incident. instead of debating what happened, you check what happened.
the takeaway
if you're investigating a suspicious file on your own machine, prefetch is one of the first places to look, right alongside browser downloads, recent files, and event logs. don't rely on it alone though, since prefetch can be disabled on some systems, cleared, or simply age out over time, so pair it with other artifacts for a fuller picture.
on your own systems, keep prefetch enabled (it's on by default and doesn't cost you anything), and if you're building out a home lab or small business setup, learn to check this folder before you assume everything's fine. the goal isn't paranoia, it's just knowing where your machine keeps its notes so you can actually read them when something looks off.