Skip to content

Windows prefetch file (.pf)

.pf file signature | application/octet-stream

Windows prefetch file. The first four bytes indicate the OS:0x11-00-00-00 = XP, 0x17-00-00-00 = Vista/Win7,and 0x1A-00-00-00 = Win8.1 (and probably Win8, as well).See"Forensic Analysis of Prefetch files in Windows".

Safe

Magic Bytes

Offset 4
53 43 43 41

Sources: Gary Kessler

Extension

.pf

MIME Type

application/octet-stream

Byte Offset

4

Risk Level

Safe

Validation Code

How to validate .pf files in Python

Python 
def is_pf(file_path: str) -> bool:
    """Check if file is a valid PF by magic bytes."""
    signature = bytes([0x53, 0x43, 0x43, 0x41])
    with open(file_path, "rb") as f:
        return f.read(4) == signature

How to validate .pf files in Node.js

Node.js 
function isPF(buffer: Buffer): boolean {
  const signature = Buffer.from([0x53, 0x43, 0x43, 0x41]);
  return buffer.subarray(0, 4).equals(signature);
}

How to validate .pf files in Go

Go 
func IsPF(data []byte) bool {
    signature := []byte{0x53, 0x43, 0x43, 0x41}
    if len(data) < 4 {
        return false
    }
    return bytes.Equal(data[:4], signature)
}

API Endpoint

GET /api/v1/pf
curl https://filesignature.org/api/v1/pf

See the full API documentation for all endpoints and parameters.

Frequently Asked Questions

What is a .pf file?

A .pf file is a Windows prefetch file file. Windows prefetch file. The first four bytes indicate the OS:0x11-00-00-00 = XP, 0x17-00-00-00 = Vista/Win7,and 0x1A-00-00-00 = Win8.1 (and probably Win8, as well).See"Forensic Analysis of Prefetch files in Windows".

What are the magic bytes for .pf files?

The magic bytes for Windows prefetch file files are 53 43 43 41 at byte offset 4. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .pf file?

To validate a .pf file, read the first bytes of the file and compare them against the known magic bytes (53 43 43 41) at offset 4. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .pf files?

There is no officially registered MIME type for .pf files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .pf files?

Windows prefetch file (.pf) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.