.pf · application/x-ms-prefetch
What is a .pf file?
Windows Prefetch File
About the format
The .pf files in C:\Windows\Prefetch are Windows' launch-optimisation notes: one per program, recording which files and directories that program touched during its first seconds, so subsequent launches can be read from disk more efficiently. The name encodes the program and a hash of its path (CHROME.EXE-ABCD1234.pf), and the content records run counts and the last eight launch times — which is why prefetch files are a staple of forensic timelines: they prove a program ran, when, and how often, even after the program itself was deleted. Modern files are compressed (they start with the bytes MAM), wrapping the older SCCA format. Deleting prefetch files is a persistent 'speed up your PC' myth — Windows just recreates them, and the first launch of every program gets slower until it does. They are safe to leave exactly where they are.
How to open a .pf file
Windows
- PECmd (Eric Zimmerman's forensic tool)
- WinPrefetchView (NirSoft)
macOS
- prefetch parsers in forensic suites
Linux
- python prefetch parsers
Is a .pf file dangerous?
No. It's telemetry about program launches — of interest to forensics, harmless to your system.
Related file types
Not sure what a file is? Check its bytes.
File names lie; magic numbers don't. Drop any file into the identifier — nothing is uploaded.
Identify a file →