pfro

$ target-query <path/to/target> -f pfro

Details

Module	os.windows.log.pfro.PfroPlugin
Output	records

Module documentation

PFRO plugin.

Function documentation

Return the content of sysvol/Windows/PFRO.log

A Pending File Rename Operation log file (PFRO.log) holds information about the process of deleting or renaming files that are locked or being used and that will be renamed on reboot. This is related to the filerenameop plugin.

References:

• https://social.technet.microsoft.com/Forums/en-US/9b66a7b0-16d5-4d22-be4e-51df12db9f80/issue-understanding-pfro-log

• https://community.ccleaner.com/topic/49106-pending-file-rename-operations-log/

Yields PfroRecords with fields:

hostname (string): The target hostname. domain (string): The target domain. ts (datetime): The parsed timestamp. path (uri): The parsed path. operation (string): The parsed operation.