pf is the Windows Prefetch Parser from TZ Works: https://tzworks.net/prototype_page.php?proto_id=1
Assuming you have a folder full of prefetch (.pf) files, from an image or from unallocated space:
for i in *.pf ; do pf -csv $i ; done | grep .pf, | cut -d, -f1,2,3,4,5 > pf-results.csv
Import into Excel for viewing the results. The file shows you how many times the executable was run and when it was last run (date and time)