dtfabric.yaml

name: scca
type: format
description: Windows Prefetch File (PF) format
urls: ["https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc"]
metadata:
  authors: ['Joachim Metz <joachim.metz@gmail.com>']
  year: 2011
attributes:
  byte_order: little-endian
layout:
- data_type: file_header
  offset: 0
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
---
name: wchar16
type: character
attributes:
  size: 2
  units: bytes
  units: bytes
---
name: file_header
type: structure
description: File header
members:
- name: format_version
  data_type: uint32
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "SCCA"
- name: file_size
  data_type: uint32
- name: executable_filename
  type: string
  encoding: utf-16-le
  element_data_type: wchar16
  elements_data_size: 60
- name: prefetch_hash
  data_type: uint32
- name: unknown1
  data_type: uint32
---
name: compressed_file_header
type: structure
description: File header
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 4
  value: "MAM\x04"
- name: uncompressed_data_size
  data_type: uint32