Which Windows artifact specifically helps identify recently executed programs and their sequence on a host?

• A. Prefetch files
• B. Windows Event Logs
• C. auth logs
• D. LSASS memory

Answer: (A)

Prefetch files are designed to capture how Windows starts programs, making them the most precise artifact for identifying what was executed recently and the order in which startup actions occurred. Each time a program runs, Windows creates or updates a corresponding prefetch file in the Windows\Prefetch folder. Those .pf files record the executable’s name, the last time it ran, and how many times it was launched, along with a list of files and resources the program accessed during startup in the sequence they were accessed. By inspecting these details across the set of prefetch files, you can determine not only which programs were executed recently but also the relative sequence of their launches, which is invaluable for mapping the execution timeline during an incident. Windows Event Logs can offer process creation events if auditing is enabled, but prefetch provides a direct, commonly available signal of recent executions and their startup order. The other artifacts listed don’t specifically tie to the exact sequence of recently executed programs in the same focused way.