Struct PrefetchInfo 

pub struct PrefetchInfo {
    pub version: u32,
    pub executable: String,
    pub run_count: u32,
    pub last_run_times: Vec<i64>,
    pub volumes: Vec<VolumeInfo>,
    pub filenames: Vec<String>,
}

The forensically-salient contents of a Windows prefetch file.

Fields

version: u32

SCCA format version (30 = Win10, 31 = Win11).

executable: String

The executable’s base name (upper-cased by Windows), e.g. COREUPDATER.EXE.

run_count: u32

Number of times the program has been run.

last_run_times: Vec<i64>

Up to eight most-recent run times, newest first, as raw FILETIME values.

volumes: Vec<VolumeInfo>

Volumes the program touched.

filenames: Vec<String>

Files (full volume-relative paths) loaded during the traced runs.

Trait Implementations

impl Clone for PrefetchInfo

fn clone(&self) -> PrefetchInfo

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PrefetchInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for PrefetchInfo

impl PartialEq for PrefetchInfo

fn eq(&self, other: &PrefetchInfo) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for PrefetchInfo