poka.sh

 Docs

PF

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

Windows Prefetch Preview.

At a glance
Purpose A Windows prefetch file (.pf): an application's run count, last run times and the files it loaded.
Extensions .pf
Poka parser poka-pf
Viewer poka-tree-viewer
Depth tier Parser with a shared viewer (see Depth tiers)
Breadth tier B3 Core (see Breadth tiers)

How much Poka reads

B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-pf/src/main.rs (611 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has sample.pf, read by no test. Covers .pf. For uncompressed files (Windows XP to 8) the tree shows the executable name, version, hash, run count, last run time, volumes and the referenced files; for MAM-compressed files (Windows 10 and 11) it shows the container header only. Judgement: B3: older prefetch files are decoded, but the compressed form written by current Windows is not decompressed.

What Poka does not read

  • Windows 10 and 11 prefetch files (MAM, LZXPRESS Huffman) are not decompressed, so only their header is shown
  • Only the last run time is shown for versions that keep eight
  • Directory strings are not listed (judgement from the code)
  • Only the first 200 referenced files are listed

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

  • frnsc-prefetch (candidate; MIT; Rust; https://github.com/ForensicRS/frnsc-prefetch) — Described as a pure Rust Windows prefetch parser; has a decompress module but MAM/Windows 10 support not confirmed by me. crates.io v0.13.3 updated 2025-02-19.
  • libscca (candidate; LGPL-3.0-or-later; unknown; https://github.com/libyal/libscca) — language: Library with Python bindings (libscca-python), implementation language not confirmed; Libyal library for the Windows Prefetch (SCCA) format; project status alpha; libscca-python 20260527 on PyPI.
  • PECmd (candidate; MIT; unknown; https://github.com/EricZimmerman/PECmd) — language: C#/.NET (inferred from repo and blog title); Command-line Prefetch parser incl. Windows 10 files; a tool rather than a library.
  • libprefetch (candidate; WTFPL; Rust; https://crates.io/crates/libprefetch) — Forensic prefetch parser; crates.io v0.1.1 last updated 2018-03-23; search listing says partial Windows 10 support.

Sources

  • parsers/poka-pf/src/main.rs
  • parsers/poka-pf/plugin.json