What is the PF file format?
A .pf file is a Windows Prefetch cache file - a proprietary binary record that the Windows Prefetcher component generates to speed up program loading. .pf files are created automatically by the operating system and stored in the C:\Windows\Prefetch folder. Each file is named NAME-XXXXXXXX.pf, where the eight-character hex suffix is a hash derived from the executable's full path. Both Windows system services and applications opened by the user generate .pf files.
.pf files significantly speed up the loading process of applications for which they are created. The Prefetch folder and its contents are therefore a part of Windows system optimization technology. Each .pf file records the DLLs and resources the program loaded during its first seconds of execution, so Windows can pre-load those assets on the next launch. On Windows 8.1 and later, .pf files are stored in MAM-compressed form (LZXPRESS Huffman encoding) to save space. Windows overwrites the oldest .pf files methodically to keep the folder within its limit - 128 entries on older releases and 1,024 on Windows 10 and later.
Performing tasks in a Windows environment will result in the Prefetch folder growing in size, sometimes reaching hundreds of megabytes. A large Prefetch folder is not a sign of an improperly configured system - quite the contrary: it indicates the system is well-optimized for application loading. .pf files can be deleted from within Windows, but it is not advised to do so, as Windows will need to rebuild them from scratch and application launch times will temporarily slow down. Digital forensic investigators value .pf files highly: on Windows 8 and later, each file logs up to eight timestamps and a cumulative run count, making .pf a primary artefact for proving which programs ran, when, and how often.
Prefetch function configuration can be modified by editing registry settings under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters. Some applications also accept a /prefetch:<number> command-line argument to control their own prefetch identity.
Security & safety
RISK: LOW.pf files are inert metadata; they don't execute. Deleting them is safe but usually pointless - Windows rebuilds them and the next launch of each app is briefly slower. The genuine concern is privacy/forensics: because .pf records what ran and when, 'anti-forensic' tools wipe Prefetch, and its absence on a normally-configured system can itself be a red flag. Malware named to mimic system files still leaves a .pf proving it executed.
Format details
in a nutshellPrograms that open PF files
Windows3 apps
WinPrefetchView (NirSoft)
Free Open the .pf to see the executable, run count, last-run times and referenced files.
PECmd (Eric Zimmerman)
Free Command-line: PECmd.exe -f file.pf (or -d on the Prefetch folder) to parse all metadata, including MAM-compressed Win10/11 files, to CSV.
Windows (the OS itself)
Built-in No action needed - Windows creates, reads and maintains .pf files automatically to speed up app launches. Technical details
deep spec| Format type | Proprietary binary cache file; SCCA (SuperFetch Cache Common Architecture) format |
| Magic bytes | SCCA at byte offset 4 (uncompressed); MAM\x04 at offset 0 (MAM-compressed, Windows 8.1+) |
| Byte order | Little-endian |
| Encoding | Binary |
| Compression | None on Windows XP through 8; LZXPRESS Huffman (MAM wrapper) on Windows 8.1 and later |
| Format versions | v17 (0x11) XP/2003; v23 (0x17) Vista/7; v26 (0x1A) Windows 8; v30 (0x1E) Windows 10; v31 (0x1F) Windows 11 |
| File naming convention | NAME-XXXXXXXX.pf - 8-character hex hash of the executable's full path appended to the program name |
| Default storage path | C:\Windows\Prefetch\ |
| Typical file size | 5 KB - 250 KB per executable |
| Folder entry limit | 128 files (Windows XP - 8); 1,024 files (Windows 10 and later) |
| Run-time recording | 1 last-run timestamp (XP/Vista/7); up to 8 timestamps plus run count (Windows 8 and later) |
| Startup trace depth | Records file paths, DLLs and resources loaded within the first ~10 seconds of execution |
| Creator | Windows OS - Prefetcher component of the Memory Manager; not created by user applications |
| Forensic relevance | Primary digital forensics artefact for execution evidence: proves a program ran, how many times, and its last eight run times |
| Released | Windows XP (2001) |
| Latest version | Format version 30/31 (Windows 10/11); MAM-compressed since Windows 8 (2012) |
| Specification | www.forensicswiki.org |
PF conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about PF files.
