user assist and pre...
 
Notifications
Clear all

user assist and prefetch difference

nightworker
(@nightworker)
Active Member

i couldnt understant that what is the difference between user assist and prefetch ?

Quote
Topic starter Posted : 27/08/2013 7:03 pm
jhup
 jhup
(@jhup)
Community Legend

prefetch

This process is designed to speed up the loading of applications (with regards to application prefetching) by storing data required by the program during the first ten seconds of use in a file - a prefetch file.

userassist

UserAssist is a method used to populate a user's start menu with frequently used applications.

http//forensicsfromthesausagefactory.blogspot.com/2010/05/prefetch-and-user-assist.html

ReplyQuote
Posted : 27/08/2013 7:14 pm
nightworker
(@nightworker)
Active Member

thank you jhup it was effective

ReplyQuote
Topic starter Posted : 27/08/2013 7:21 pm
keydet89
(@keydet89)
Community Legend

Application prefetching is a means that MS uses to track the use of commonly-accessed applications, whereby the application launch process is tracked (on Windows XP, it was based on page faults within the first 10 sec of application start) so that the initial code needed is stored in one location, speeding up launch time. This has the effect of producing the *.pf files that DFIR analysts can use to great effect during an examination.

Application prefetch files are not specific to a user.

UserAssist consists of a series of Registry subkeys within the user's NTUSER.DAT hive, that have the effect of recording information about the user's interaction with the system via the Windows Explorer shell. When a user launches an application, either by double-clicking the icon in Explorer, navigating the Program Menu, etc., the last instance of this is activity is updated via these keys. The value names beneath the keys are Rot-13 "encrypted", and the value data contains information about when the action was last performed, how many times the action was performed, etc.

HTH

ReplyQuote
Posted : 27/08/2013 8:01 pm
Share: