Prefetch C:\Windows\Prefetch

C:\Windows\Prefetch: .pf prefetch files for launched applications, rebuilt by Windows. Also a valuable execution trace in forensics.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Prefetch keeps, for each program launched, a record of what it loaded and in what order, so its next launches are faster. It is a cache that Windows rebuilds by itself. In forensics, it is also evidence that a program ran.

What it contains

.pf files named PROGRAM-NAME-HASH.pf, one per executable launched (for example NOTEPAD.EXE-D8414F97.pf).
Inside each .pf: the list of files loaded, the run count and the dates of the latest runs (up to eight since Windows 8).
Data used by the SysMain service (formerly Superfetch).
The number of files is capped (1024 since Windows 8), so the folder does not grow forever.

Risks and best practices

You can empty it, but it speeds nothing up: Windows recreates the files as programs launch, and the first launches afterwards are a little slower. A corrupted cache is fixed the same way.
Empty the contents, never the folder itself.
On a suspect machine, copy the folder before any cleanup. A .pf file’s name, creation date and run count establish that a program ran, even if it has since been deleted.

Useful commands

# Number and size of .pf files
Get-ChildItem "$env:windir\Prefetch" -Filter *.pf | Measure-Object -Property Length -Sum

# .pf files of one program, newest first
Get-ChildItem "$env:windir\Prefetch" -Filter 'POWERSHELL*.pf' | Sort-Object LastWriteTime -Descending | Select-Object Name, CreationTime, LastWriteTime

# Prefetch configuration (0 = disabled, 1 = applications, 2 = boot, 3 = both) and SysMain service state
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters' | Select-Object EnablePrefetcher, EnableSuperfetch
Get-Service SysMain

# Simulate deletion (remove -WhatIf to run it, as administrator)
Remove-Item "$env:windir\Prefetch\*.pf" -WhatIf

Report a mistake