What is this Windows folder for?

What is this Windows folder for?

269 native Windows items documented (167 folders, 52 files, 50 logs): what they are for, what they contain, their related logs and the official Microsoft sources. For technicians and administrators.

Which folder?

Search

Browse the directory treeFrom any page Ctrl K

Directory tree269

• C:\
• PerfLogs
• Program Files
• ProgramData
• Users
• Windows
• Boot
• Fonts
• Logs
• Minidump
• Prefetch
• SoftwareDistribution
• System32
• Temp
• WinSxS

SafeCautionDo not touch

1. C:
2. Windows
3. Prefetch

FolderRisk: Safe

Prefetch

C:\Windows\Prefetch: .pf prefetch files for launched applications, rebuilt by Windows. Also a valuable execution trace in forensics.

What it's for

Prefetch keeps, for each program launched, a record of what it loaded and in what order, so its next launches are faster. It is a cache that Windows rebuilds by itself. In forensics, it is also evidence that a program ran.

What it contains

.pf files named PROGRAM-NAME-HASH.pf, one per executable launched (for example NOTEPAD.EXE-D8414F97.pf).

Browse by type and by risk

By type

• Folders167
• Files52
• Logs50

By risk

• Safe26
• Caution162
• Do not touch81

Browse by location

• C:\36 itemsRoot of the system drive: top-level folders, paging and hibernation files, recycle bin, upgrade folders.
• C:\Windows88 itemsThe operating system, excluding System32: fonts, logs, updates, drivers, component store.
• C:\Windows\System3291 itemsThe core of the system: libraries, executables, drivers, registry and event logs.
• C:\ProgramData18 itemsApplication and service data shared by all users.
• C:\Users36 itemsUser profiles: documents, settings and application data (AppData).
• Logs50 itemsFiles that record events for diagnostics, wherever they live on the disk.

Support this site

This site is free and ad-free. A voluntary donation helps keep it up to date and growing.

Support me on Ko-fi(external link)

Getting started

• C:WindowsSystem32Core of the system: libraries, drivers, tools and configuration. On 64-bit Windows it holds the 64-bit binaries.
• C:WindowsWinSxSWinSxS: the Windows component store, holding system file versions for installing, repairing and updating. Never empty it by hand.
• C:ProgramDataApplication data shared by all users of the machine (configuration, caches, logs); hidden by default.
• C:Users<utilisateur>AppDataHidden profile folder where applications keep per-user data, in three branches: Local, LocalLow and Roaming.
• C:WindowsLogsCBSCBS.logMain Component-Based Servicing log: update installation and detailed sfc /scannow results ([SR] entries).
• C:WindowsSystem32winevtLogsFolder holding the Windows event logs in .evtx format, read by Event Viewer.

Other references

• ADMX ExplorerComing soonReference for Group Policy settings (ADMX templates) for Windows and applications.