Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.
You can get a command line tool that uses this libary here:
https://github.com/EricZimmerman/PECmd
#NOTE You need to run this code on at least Windows 8 in order for the decompression of Windows 10 prefetch files to work. I still have to some testing on failing gracefully if run on < Windows 8 if Windows 10 prefetch (version 30) files are found.
- Split out Win8x into Win80 and Win81 for test cases