{"id":13597743,"url":"https://github.com/EricZimmerman/PECmd","last_synced_at":"2025-04-10T05:33:21.674Z","repository":{"id":45730685,"uuid":"50198821","full_name":"EricZimmerman/PECmd","owner":"EricZimmerman","description":"Prefetch Explorer Command Line","archived":false,"fork":false,"pushed_at":"2025-01-08T20:16:36.000Z","size":4725,"stargazers_count":234,"open_issues_count":0,"forks_count":37,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-01-08T20:34:13.191Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EricZimmerman.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-01-22T18:13:48.000Z","updated_at":"2025-01-08T20:16:40.000Z","dependencies_parsed_at":"2024-11-06T22:35:03.961Z","dependency_job_id":"b2ecccd1-1622-4fca-96b3-6917bcdaf0de","html_url":"https://github.com/EricZimmerman/PECmd","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FPECmd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FPECmd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FPECmd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EricZimmerman%2FPECmd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EricZimmerman","download_url":"https://codeload.github.com/EricZimmerman/PECmd/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248163361,"owners_count":21057918,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T17:00:40.136Z","updated_at":"2025-04-10T05:33:16.634Z","avatar_url":"https://github.com/EricZimmerman.png","language":"C#","funding_links":[],"categories":["Operating Systems","C# #","Tool-Related GitHub Repos"],"sub_categories":["Windows","EZ Tools"],"readme":"# PECmd\n\n## Command Line Interface\n\n     PECmd version 1.4.0.0\n    \n     Author: Eric Zimmerman (saericzimmerman@gmail.com)\n     https://github.com/EricZimmerman/PECmd\n     \n             d               Directory to recursively process. Either this or -f is required\n             f               File to process. Either this or -d is required\n             k               Comma separated list of keywords to highlight in output. By default, 'temp' and 'tmp' are highlighted. Any additional keywords will be added to these.\n             o               When specified, save prefetch file bytes to the given path. Useful to look at decompressed Win10 files\n             q               Do not dump full details about each file processed. Speeds up processing when using --json or --csv. Default is FALSE\n     \n             json            Directory to save json representation to.\n             jsonf           File name to save JSON formatted results to. When present, overrides default name\n             csv             Directory to save CSV results to. Be sure to include the full path in double quotes\n             csvf            File name to save CSV formatted results to. When present, overrides default name\n             html            Directory to save xhtml formatted results to. Be sure to include the full path in double quotes\n             dt              The custom date/time format to use when displaying timestamps. See https://goo.gl/CNVq0k for options. Default is: yyyy-MM-dd HH:mm:ss\n             mp              When true, display higher precision for timestamps. Default is FALSE\n     \n             vss             Process all Volume Shadow Copies that exist on drive specified by -f or -d . Default is FALSE\n             dedupe          Deduplicate -f or -d \u0026 VSCs based on SHA-1. First file found wins. Default is TRUE\n\n             debug           Show debug information during processing\n             trace           Show trace information during processing\n     \n     Examples: PECmd.exe -f \"C:\\Temp\\CALC.EXE-3FBEF7FD.pf\"\n               PECmd.exe -f \"C:\\Temp\\CALC.EXE-3FBEF7FD.pf\" --json \"D:\\jsonOutput\" --jsonpretty\n               PECmd.exe -d \"C:\\Temp\" -k \"system32, fonts\"\n               PECmd.exe -d \"C:\\Temp\" --csv \"c:\\temp\" --csvf foo.csv --json c:\\temp\\json\n               PECmd.exe -d \"C:\\Windows\\Prefetch\"\n\n               Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes\n\n## Documentation\n\nIf you are running less than Windows 8 you will NOT be able to process Windows 10 prefetch files.\n\n[Windows Prefetch parser in C#](https://binaryforay.blogspot.com/2016/01/windows-prefetch-parser-in-c.html)\n[Introducing PECmd!](https://binaryforay.blogspot.com/2016/01/introducing-pecmd.html)\n[PECmd v0.6.0.0 released](https://binaryforay.blogspot.com/2016/01/pecmd-v0600-released.html)\n[PECmd, LECmd, and JLECmd updated!](https://binaryforay.blogspot.com/2016/03/pecmd-lecmd-and-jlecmd-updated.html)\n\n# Download Eric Zimmerman's Tools\n\nAll of Eric Zimmerman's tools can be downloaded [here](https://ericzimmerman.github.io/#!index.md). Use the [Get-ZimmermanTools](https://f001.backblazeb2.com/file/EricZimmermanTools/Get-ZimmermanTools.zip) PowerShell script to automate the download and updating of the EZ Tools suite. Additionally, you can automate each of these tools using [KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)!\n\n# Special Thanks\n\nOpen Source Development funding and support provided by the following contributors: \n- [SANS Institute](http://sans.org/) and [SANS DFIR](http://dfir.sans.org/).\n- [Tines](https://www.tines.com/?utm_source=oss\u0026utm_medium=sponsorship\u0026utm_campaign=ericzimmerman)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2FPECmd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FEricZimmerman%2FPECmd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FEricZimmerman%2FPECmd/lists"}