Why Prefetch Artefacts are Like Ducks

This talk will provide an introductory guide to prefetch examination, focusing on potential applications for forensic analysis. Suitable for those unfamiliar with the field, configuration of these artefacts is explored, covering their purpose, configuration and format. Running through an example case, we examine the significance of these artefacts for timeline construction before concluding with limitations and current tooling, so that you too can play James Pond.