# Prefetch-Hash-Cracker | A Small Util To Brute-Force Prefetch Hashes **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking, freebies\ **Created:** [November 9, 2022, 8:57pm UTC](https://onehack.st/t/prefetch-hash-cracker-a-small-util-to-brute-force-prefetch-hashes/228168 "2022-11-09T20:57:31Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\ **Post date:** [November 9, 2022, 8:57pm UTC](https://onehack.st/t/prefetch-hash-cracker-a-small-util-to-brute-force-prefetch-hashes/228168/1 "2022-11-09T20:57:31Z")
![image](https://onehack.st/uploads/default/original/3X/7/b/7bffd8cae12696bc51c2b82e13bc904ec0d512c5.png) ## Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. ## Using the tool The following fields must be provided: - _Executable name_ Including the extension. It will be embedded in the prefetch filename, unless [this](https://github.com/harelsegev/prefetch-hash-cracker#The-29-character-limit) happens. - _Prefetch hash_ 8 hexadecimal digits at the end of the prefetch filename, right before the `.pf` extension. - _Hash function_ - _Bodyfile_ - _Mount point_ ### Hash function There are 3 known prefetch hash functions: - _SCCA XP_ Used in Windows XP - _SCCA Vista_ Used in Windows Vista and Windows 10 - _SCCA 2008_ Used in Windows 7, Windows 8 and Windows 8.1 ### Bodyfile A bodyfile of the volume the executable was executed from. The bodyfile format is not very restrictive, so there are a lot of variations of it - some of which are not supported. Body files created with `fls` and `MFTECmd` should work fine. ### Mount point The mount point of the bodyfile, as underlined below: ```auto 0|C:/Users/Peter/Desktop ($FILE_NAME)|62694-48-2|d/d-wx-wx-wx|... ``` ## How does it work? The provided bodyfile is used to get the path of every folder on the volume. The tool appends the provided executable name to each of those paths to create a list of possible full paths for the executable. Each possible full path is then hashed using the provided hash function. If there’s a possible full path for which the result matches the provided hash, that path is outputted. ## Limitations The following cases are not supported: - Hosting applications, such as `svchost.exe` and `mmc.exe` - Applications executed with the `/prefetch:#` flag - Applications executed from a UNC (network) path ### The 29-character limit If the executable name is longer than 29 characters (including the extension), it will be truncated in the prefetch filename. For example, executing this file: ```auto This is a very long file nameSo this part will be truncated.exe ``` From the `C:\Temp` directory on a Windows 10 machine, will result in the creation of this prefetch file: ```auto THIS IS A VERY LONG FILE NAME-D0B882CC.pf ``` In this case, the executable name cannot be derived from the prefetch filename, so you will not be able to provide it to the tool. ## License [MIT](https://choosealicense.com/licenses/mit/) ## GitHub: > **[GitHub - harelsegev/prefetch-hash-cracker: A small util to brute-force prefetch hashes](https://github.com/harelsegev/prefetch-hash-cracker)** > > A small util to brute-force prefetch hashes