Jump to content

Prefetch Hash Cracker: brute-force prefetch hashes v0.2.0


itsMe
 Share

Recommended Posts

This is the hidden content, please

Prefetch Hash Cracker

During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created.


How does it work?

The provided bodyfile is used to get the path of every folder on the volume. The tool appends the provided executable name to each of those paths to create a list of possible full paths for the executable. Each possible full path is then hashed using the provided hash function. If there’s a possible full path for which the result matches the provided hash, that path is outputted.

This is the hidden content, please

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

Chat Room

Chat Room

Chatroom Rules

No support in chat, open a thread.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.