PECmd (Prefetch Explorer Command Line) is the de facto standard DFIR tool for parsing Windows prefetch (.pf) files. It extracts the executable name, hash, run count and last-run timestamps, volume information, and directory/file references from every prefetch version including XPress/Huffman-compressed Windows 10/11 files, and renders results to the console, CSV (a per-file report plus a per-run timeline), JSON (one object per file, ISO 8601 UTC timestamps), or XHTML. Beyond basic parsing it can process Volume Shadow Copies (--vss via the ERZHelpers library's VSS mounting), scan NTFS alternate data streams for prefetch data hidden by ADS-executed binaries (--ads, including the empty-primary-stream edge case), deduplicate inputs by SHA-1, and save decompressed raw bytes (-o). The parsing core itself lives in the separate Prefetch NuGet package; this repository is the operational shell handling CLI parsing, file enumeration, VSS/ADS orchestration, error resilience, and all export formats. Architecture-wise this is a single C# project multi-targeting net472 and net10.0, built around one monolithic Program.cs (~1500 lines) that owns argument handling (System.CommandLine), recursive file discovery (AlphaFS on net472, a custom FileSystemEnumerator on modern .NET), export serialization (CsvHelper, ServiceStack.Text, XmlTextWriter), and Serilog console/file logging. The code is pragmatic and battle-tested rather than architecturally elegant: static mutable state (shared keyword set, failed-file list, processed-file list) and a god-file style limit modularity and testability (the project explicitly has no tests). What it lacks in structure it makes up for in domain rigor: read errors (access denied, locked files) are carefully distinguished from parse errors (damaged files reported but exit code 0; unreadable input yields exit code 1), unreadable folders are surfaced instead of silently skipped, and the Windows 10+ prefetch hash-validation quirk is handled with real forensic depth. Highlighted reusable logic: ExecutablePathResolver, a cleanly isolated component that resolves an executable's full path from prefetch file references and validates it against the file's hash — including iterating \DEVICE\HARDDISKVOLUME{n} candidates because Windows 10+ stores volume-GUID paths but hashes the native device path. Also notable is the private EntryFinder, a FileSystemEnumerator subclass that captures per-folder read errors during recursive walks without aborting — a genuinely non-obvious pattern worth extracting for any resilient file-walking tool. Maintenance is active (2026.10.3, embedded PDBs for deterministic stack traces, Exceptionless telemetry, SmartAssembly-protected release pipeline) and the README/CLAUDE.md documentation is unusually precise about intentional engineering trade-offs.