How to analyse prefetch files from harddrive

pf is the Windows Prefetch Parser from TZ Works:

Assuming you have a folder full of prefetch (.pf) files, from an image or from unallocated space:

for i in *.pf ; do pf -csv $i ; done | grep .pf, | cut -d, -f1,2,3,4,5 > pf-results.csv

Import into Excel for viewing the results. The file shows you how many times the executable was run and when it was last run (date and time)