What Windows artifact reveals program startup information and helps reconstruct execution flow?

• A. Recycle Bin
• B. Windows Registry
• C. Prefetch files
• D. Event Logs

Answer: (C)

Prefetch files are the artifact that reveals how a program starts and what happens during its launch. When a program is run, Windows creates a corresponding prefetch file that records the executable’s path and the list of files the process opened during startup, including DLLs and other resources. It also notes how many times the program has run and the last run time. This snapshot lets an investigator understand the sequence of actions the program took as it started, including which modules loaded and in what order, which helps reconstruct the execution flow.

Other options provide different kinds of information but not the same startup-level detail. The Recycle Bin only holds deleted items and doesn’t reflect how an application started. The Windows Registry can show programs configured to run at startup, but it doesn’t reveal the actual run-time sequence or loaded components. Event Logs capture system and application events, but they don’t give a detailed view of the internal startup steps and files accessed by a program.

So, the best artifact for uncovering startup activity and tracing execution is the prefetch file.