How to list prefetch files from memory

This will list all the prefetch files from the memory dump:

volatility -f /path/to/memory/dump.001 -profile=<profile> prefetchparser > prefetchparser-results.txt

This is useful if the prefetch folder has been cleared.

I don’t know of any way to carve out all prefecth files from a memory, as apparently not the entire content is saved in memory, but the name alone and the indication that it has been run, can prove useful.