More about the Prefetcher

So far, there hasn't been much of a response to my previous Prefetch blog post...though I have heard that some folks have been thinking along those lines. I wanted to add a couple of things I've stumbled across...

First, XP prefetches for the boot process and application launch, by default, while 2003 only prefetches for the boot process. As a system hardening recommendation, I'd suggest modifying the 2003 Registry value to prefetch for application launches, as well. The Prefetch directory shouldn't take up a great deal of space...for servers, pretty much the same applications will be launched over and over, so the predominant changes to the directory will be updates to file access times. However, if any unusual applications are launched, a record (ie, a '.pf' file) will be created in the Prefetch directory.

Second, I thought I mention something about the layout.ini file that you see in the Prefetch directory. This file is used by the system defrag tool to optimize system performance, by placing all of the files and directories listed in the layout.ini file in the same contiguous space. Having all of these files and directories close together in the same place makes the access of those objects more efficient.

So...what I did today was write a Perl script that parses the layout.ini file for executable files (based on .exe, .dll, and .sys file extensions) and then extract file version information from each of these. This script can easily be modified to flag files that aren't Microsoft (or Adobe or Symantec) files, or on files that don't have file version information. I should probably add extracting MAC times, as well, prior to grabbing file version info.

Here's an excerpt from the output of the script:

C:\WINDOWS\SYSTEM32\USERINIT.EXE
File Version : 5.1.2600.2180
Product Version : 5.1.2600.2180
OS : NT/Win32
Type : Application
CompanyName : Microsoft Corporation
FileDescription : Userinit Logon Application
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName : userinit
Copyright : © Microsoft Corporation. All rights reserved.
Trademarks :
OrigFileName : USERINIT.EXE
ProductName : Microsoft® Windows® Operating System
ProductVersion : 5.1.2600.2180
PrivateBuild :
SpecialBuild :

This sort of thing is extremely useful, allowing for quicker searches of "suspicious" files. The key is in understanding how the Prefetch directory and the layout.ini file are populated, and then determining how they can be used (exploited??) by a forensic analyst.