My, You Look Super Fetching Tonight!
DoD Cyber Crime Conference, 2008

Slides (pdf)    

Windows Vista’s new SuperFetch feature records when applications are run. This allows the system to load files into memory just before they’re needed and makes the computer appear faster. This talk explains SuperFetch and its precursor Prefetch. What information is available and how to extract the stored usage profiles is shown. Now you can quickly determine if the box is used, for example, for work, playing Halo, or viewing illicit imagery.

Home     Publications     Presentations     Utilities     Tools     Blog