{"success":true,"data":{"ext":"pf","name":"Windows prefetch file","description":"Windows Prefetch files are system-generated cache files created and maintained by Microsoft Windows to record application startup behavior. They are used by the operating system to improve program launch performance and are also examined by forensic tools to reconstruct recent application activity. These files are generally safe, but they may reveal usage patterns and are version-dependent, with internal structure varying across Windows releases.","mime":[],"risk_level":"Safe","signatures":[{"hex":"53 43 43 41","offset":4,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":[],"usage":{"python":"def is_pf(file_path: str) -> bool:\n    \"\"\"Check if file is a valid PF by magic bytes at offset 4.\"\"\"\n    signature = bytes([0x53, 0x43, 0x43, 0x41])\n    with open(file_path, \"rb\") as f:\n        f.seek(4)\n        return f.read(4) == signature","node":"function isPF(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x53, 0x43, 0x43, 0x41]);\n  if (buffer.length < 8) return false;\n  return buffer.subarray(4, 8).equals(signature);\n}","go":"func IsPF(data []byte) bool {\n    signature := []byte{0x53, 0x43, 0x43, 0x41}\n    if len(data) < 8 {\n        return false\n    }\n    return bytes.Equal(data[4:8], signature)\n}"}}}