When a Windows system boots, a large number of files need to be read into memory and processed. Oftentimes this includes loading different segments of the same file at different times. As a result, a significant amount of time is spent opening and accessing files multiple times, where a single access would be more efficient. The prefetcher works by watching what code and data is accessed during the boot process (including reads of of the NTFS Master File Table), and recording a trace file of this activity. Future boots can then use the information recorded in this trace file to load code and data in a more optimal fashion. The boot prefetcher will continue to watch for such activity until 30 seconds after the user's shell has started, or until 60 seconds after all services have finished initializing, or until 120 seconds after the system has booted, whichever elapses first.
Application prefetching works in a similar fashion, but is instead localized to a single application's startup. Only the first 10 seconds of activity is monitored.
The prefetcher stores its trace files in the "Prefetch" folder in the root Windows directory (typically \Windows\Prefetch). The name of the boot trace file is always NTOSBOOT-B00DFAAD.PF, and application trace files are a concatenation of the application's executable name, a hyphen, a hexdecimal representation of the hash of the path the file resides in, and a ".pf" extension. Applications that host other components (i.e. Microsoft Management Console or Dllhost) have the name of the loaded component included in the computed hash as well; this results in different trace files being created for each component.
It is important to note that the Task Scheduler is the process responsible for parsing the trace data collected by the prefetcher and writing files to the Prefetcher directory. As a result, the Prefetcher will not operate correctly if the Task Scheduler service is not started.
An additional feature of the Task Scheduler is its ability to interact with the Disk Defragmenter. Every three days, when the machine is idle, a list of files and directories that are referenced during the boot process and application startups is created. This list is stored in Layout.ini in the Prefetch directory, and is subsequently passed to the Disk Defragmenter, instructing it to place all the files in sequential order on the physical hard drive, which will further improve startup performance, as Windows will spend less time waiting for the hard drive's heads to move to the relevant data.
