Windows Prefetch Forensics and Program Execution Timeline

Hard GIAC GCFA cybersecurity drill: You are reconstructing the timeline of an attacker's activity on a Windows workstation. Windows Prefetch files (.pf)