PrefetchBrowser
[Update]
- Now lists & reads Prefetch (.pf) files hidden in Alternate Data Streams
e.g. : 'WELCOME2.TXT:REVSHELL.EXE-41B5A636.pf'
Ref: # Creating a Hidden Prefetch File to Bypass Normal Forensic Analysis
[Update]
Ref: # Creating a Hidden Prefetch File to Bypass Normal Forensic Analysis