Adam Witt has presented a fresh Python script. It’s called┬áWindows Prefetch Carver and, as you already understood, can be used to carve Windows Prefetch artifacts from arbitrary binary data. Unfortunately, Windows 10 Prefetch files are compressed, and are unable to be carved from disk in this manner, but all other Prefetch formats are supported (Windows XP – Windows 8.1).

Load More Related Articles
Load More In Software

Leave a Reply

Your email address will not be published. Required fields are marked *