Skip to content
Get packs

Windows Prefetch Forensics

Parse Windows Prefetch files to reconstruct program execution history for incident response

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this skill teaches an AI agent how to read Windows Prefetch files (small .pf records Windows keeps of programs it has run) using the windowsprefetch Python library. The agent can then list which programs ran, how many times, when they last ran, and which files and volumes they touched, and build a timeline. It also gives guidance for spotting renamed or disguised programs and known attack tools. It is aimed at forensic and incident-response work rather than everyday computer use.

Great for

  • Incident responders reviewing a Windows machine for signs of malware or intrusion
  • SOC analysts or digital forensics students learning how Prefetch evidence is used
  • Security teams verifying when a suspicious program actually ran

Skip it if

  • Ordinary users trying to speed up Windows; Prefetch is a performance cache and this skill does not tune it (wrong purpose)
  • Anyone analysing Prefetch files from systems they do not have authority to examine, since the output can expose user activity (privacy and legal risk)
  • Treating the suspicious-name list as proof of compromise; names like certutil or rundll32 are routinely used by legitimate software (false positives)

Try asking

  • “Parse the Prefetch folder from this evidence image and list every program run in the last three days with run counts”
  • “Build a chronological execution timeline from these .pf files for the incident window 2024-01-15 to 2024-01-18”
  • “Flag any executables whose names suggest credential-dumping or lateral-movement tools and show their paths”
  • “Check whether a binary named update_client.exe loaded DLLs that look unusual for its location”
Step-by-step guide: how to use Windows Prefetch ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-windows-prefetch-with-python.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-windows-prefetch-with-python.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-windows-prefetch-with-python.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy of the evidence, not the live system, so you do not alter forensic artefacts
  • Treat flagged items as leads to verify against other evidence such as event logs, file hashes and timestamps
  • Note that the example output in SKILL.md is illustrative; check the real script's output format before relying on it

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.