Forensic value of the Prefetch directory

XP Pro client , part of a domain with the EnablePrefetcher value set to (3) which is I believe the default.

Andrew-

Andrew,

Thanks. I'll need to check it out on a couple more XP Home clients.

H. Carvey
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com