Beware of Bogus XP Advice
This question appeared on a bulletin board recently:
Someone suggested deleting the contents of the Prefetch directory in Windows XP on a weekly basis, to speed up the boot process. Is that good advice?
The Internet has a way of taking questionable facts and giving them a life of their own. Even bad advice about Windows has a way of spreading, just like urban legends. This is one of those “tips” that doesn’t survive even a cursory analysis.
The Prefetch directory serves a valuable purpose by analyzing files that you use at startup and when you run programs. Contrary to what some well-meaning but technically inaccurate articles suggest, this does not copy the files themselves. It creates an index to the location of those files on the hard disk, including the order in which they’re loaded. This allows Windows and Windows programs to start very quickly after the first time you use them.
The Prefetch directory has one additional salutary function when used in conjunction with the built-in defragmenting tool. Every three days, during idle times, this utility rearranges program code, moving it to the outside of the disk to make it more efficient when loading (to force Windows to perform this optimization without having to do a full defragmentation, use the Defrag.exe command with the -b switch. For instance: defrag c: -b).
Carl Siechert, Craig Stinson, and I actually devoted several pages of Windows XP Inside Out to this topic. That was almost two years ago, though, and I’m willing to keep an open mind that we might have missed a great tip. So, just for grins, I got out my stopwatch and clocked my system boot time. Then I cleared out the Prefetch directory and did it again. My system has been running nonstop for 7 months and I have never touched the Prefetch directory. If this “tweak” were going to do any good, surely it would have maximum effect on my computer, right? The results were illuminating.
I timed from power up, starting with the first beep (POST code) to the point where the hourglass cursor disappeared.
With a full Prefetch directory:
… 0:50 to login screen
… 1:08 to desktop
After emptying Prefetch directory:
… 0:58 to login screen
… 1:57 to desktop
In other words, it took me nearly a minute longer to boot after using this “speedup” tip!
When I Googled for this topic, I found tons of examples of people who had simply copied this advice to their list of “tips” without any explanation of why it would be valuable or whether it actually affects performance. Mark Russinovitch and David Solomon, for instance, wrote an excellent article called Windows XP Kernel Improvements Create a More Robust, Powerful, and Scalable OS in the December 2001 issue of MSDN Magazine. Their technical credentials are impeccable, and they speak very highly of this feature.
The few people who did discuss it in those terms were unanimous in recommending that you leave Prefetching on.
Furthermore, why worry about boot times anyway? I recommend that most people avoid restarting their computer except when it’s absolutely required. Windows XP is so stable you can leave it running for weeks at a time and only restart on those rare occasions when you have to do so. If you need to shut down the computer, use the Hibernate option instead, which allows you to resume in seconds, with all your programs loaded just the way they were when you shut down.
If you really want to improve performance, forget bogus tweaks like this one and do the following: increase the amount of RAM in your computer (at least 256MB), get a good defragmenter (Diskeeper is the best), and remove programs you don’t use (or at least configure them so they don’t start automatically).
Update, March 2005: This “tip” just won’t die. It still appears all over the Internet, including at some places that should know better. We revisited the topic for the second edition of Windows XP Inside Out and found that cleaning out the Prefetch folder still does nothing positive for performance. If you think otherwise, get a stopwatch and run your own tests.
Update, May 2005: Microsoft’s Ryan Myers has an excellent blog post on the subject, entitled “Misinformation and the Prefetch Flag.” Here’s the money quote: “[I]t is a bad idea to periodically clean out that folder as some tech sites suggest. For one thing, XP will just re-create that data anyways; secondly, it trims the files anyways if there’s ever more than 128 of them so that it doesn’t needlessly consume space. So not only is deleting the directory totally unnecessary, but you’re also putting a temporary dent in your PC’s performance.”
Be sure to read these follow-up articles as well: Don’t clean out the Prefetch folder, Debunking yet another bogus Windows tip, and One more time: do not clean out your Prefetch folder!
90 Responses to Beware of Bogus XP Advice
I found prefetch mentioned on the MS web site
Link 1
Link 2
Link 3
Link 4
In summary, what Ed has been telling everyone is absolutely 100% correct. All the stuff you are reading at the ‘other’ web sites is incorrect and pushing something on to you that you really should not be doing (deleting prefetch entries). Most of the sites I’ve seen articles containing the ‘delete prefetch entries’ are techy sites that try to draw attention by creating big stirs on something like this. It’s rather unfortunate, but those are like the Enquirer magazine – you really need to research that information before applying it. So, I have supplied links such that everyone can do their own reading and research and come to their own conslusion. For the most part, you will see that Ed is correct and the other sites spoken of are not.
Cheers,
Chuck
[I edited this comment to make the links clickable - Ed]
Will purging the prefetch folder fix issues that one is having with a coruption in the taskmanager program? If not then what would be the best place to start diagnosis to fix errors in the taskmanager program?
I’ve seen reports that defrag -b moves this prefetch data to the outer edge of the disk.
In all benchmarks I’ve seen and tried, thats the slowest part of a modern hard drive, so what gives?
Ben
I don’t see how benchmarks could possibly have reported the outside of the disk as the slowest part. Recalling high school science classes …
The outside completes a rotation in the same amount of time as the inside, but the outside must travel a much greater distance. The only way that the circumference of a wheel/disc/frisbee/etc. can travel a greater distance in same time period is to spin faster than the inner portion.
The faster a disk drive spins, the faster the heads can read data from the disk. Outside spins more quickly than inside. Ergo, outside is the fastest read/write area of a disk drive.
I’m a non-tech, non-science guy, but I’m fairly certain I’ve got this one right.
Read the entire thread and decided not to bother cleaning the prefetch, but here is what pcpitstop is telling the world in its June “what’s new” email:
Performance Tip: Prune Your Prefetch
Windows XP speeds up boot time using information that it keeps in the Prefetch folder under the Windows folder (usually this is C:\Windows\Prefetch on most PCs). Over time as many programs are installed and removed, the prefetch information can actually hurt performance. If your startup times are lagging, you can delete the .pf files in the Prefetch folder and Windows XP will rebuild them as needed. While you’re cleaning, it’s a good time
to empty the Recycle Bin, clear your IE cache, and defrag the drive for best performance.
I have used and trusted pcpitstop for years. Should I reconsider?
This looks like yet another example of someone who said, “Well, it’s reprinted in a thousand places on the Internet, so it must be true.”
I sent an e-mail to Dave Methvin, a friend who is also Chief Technical Officer at PC Pitstop. We’ll see what he has to say.
As I said to Ed, mea culpa. I believed this tip myself and do clean out the folder as part of some routine maintenance. Given my system setup (weekly defrags, daily junk file cleanup, 2GB of RAM, system runs 24/7 with about 1 boot every two weeks) I doubt it’s actually hurting performance. But the goal is to really improve speed and that’s a higher bar. So ignore that tip, and we’ll do a better job of vetting them in the future.
Hello Ed! I was browsing Google to see why a Gateway Profile I am working on doesn’t load the MS windowsupdate page and saw your blog on Prefetch and decided to read it on through.
My take on Prefetch…. I like to purge it fairly regularly and performance issues don’t enter into this cleaning. I do it strictly for malware cleaning and prevention. After watching Steven Gould’s free Cleanup! program run on a few hundred machines I have seen more spyware-related files in the Prefetch folder than I care to remember. The file mentioned by Dean in the earlier reply (IKFQDLL.EXE ) being an example of a random-named Trojan. Rule of thumb for anti-spyware technicians : “If the filename isn’t found in Google, then it is almost certainly hostile”).
So for me, with a fast hard drive and plenty of RAM, I purge it once a week. For spyware-infested computers I always purge Prefetch.
All the best,
Russell Smith
Well, hey there, Russell! Good to see your name in the comments.
While I always respect your point of view, I have to disagree with you here. The files in the Prefetch folder are .pf files. They are not executable, not even remotely. They are created by the operating system and are only consulted when you, the user, or an agent you have installed actually executes a program.
Now, the thing that confuses most people is that the name of the .pf file actually contains the name of the executable file whose layout it defines. So someone looking at it in a cursory fashion might think, aha! Those wily crapware makers are hiding files here too. Death to spyware! Death!
Ahem. Sorry, where was I? Oh yes. Those .pf files are not doing a thing that’s bad. If you get rid of the underlying executable, the .pf file will represent a map to a territory that no longer exists. The .pf file will disappear in two weeks after being unused the whole time. If you don’t get rid of the underlying executable, on the other hand, the .pf file will be re-created the next time it runs. Which means that deleting it is pointless and all effort should be put into finding and zapping the executable file.
Deleting the contents of the Prefetch folder may appeal to someone who wants to be 110% sure. But deleting those .pf files has no practical effect on your security. None at all.
Respectfully,
Ed
Yes, I realize the .pf files are harmless per se (although some antimalware experts report problems in cleaning up hostile .exe files with software cleaners unless the Prefetch entries with that file are removed). I haven’t experienced this myself.
I can only report as an eyewitness while cleaning up spyware-infested computers in person (I do this part time now and pick up computers and bring to my house for a thorough cleaning) that in several of the past 100 computers I have found hostile .exe files (plus another file with the .pf association) in the Prefetch folder. As a hidden folder Prefetch appears to be an infrequent, but nevertheless a tempting target for some Trojan writers. The Prefetch folder on these past hundred or so computers could have contained more examples of true .exe files, but I only examined the folder on a few prior to purging Prefetch with one of my tools (CCleaner or Cleanup!).
More frequently I find the writers use these depository folders: Program Files (the root and more commonly a new random-named subfolder; Windows\System32 folder, Windows folder, all the user temp folders (a hotbed of activity) and the root C: level.
So I just save my time during a cleanup and purge all temp files and the Prefetch folder first before I run my regimen of the major free antispyware tools.
All the best,
Russell
Isn’t all the discussion of the prefetch folder diverting from the RAM issue? If Windows does preload material into RAM, then it is occupying memory which in a low memory machine will affect performance.
If this is a real issue, you can turn prefetching off for files by making a change in the registry and live with the consequences if any.
Glenn,
It doesn’t actually preload anything into RAM until you run the program, and when you do that, prefetching only works if you have RAM to spare. So nothing to worry about.
Ed
Hi, Ed.
This is related, but slightly different.
I just read an article (a very short post at http://www.theinquirer.net) that mentions this: Longhorn has a Registry entry called “EnableSuperfetch” with a value of 1; this is possibly in addition to the XP entry of “EnablePrefetch” with its default value of 3.
The person states that the speed improvement of Longhorn can be achieved in XP by simply adding the “EnableSuperfetch” entry.
I hesitate to make this change on my one production PC until I’ve researched this just a little. Google provided no hits on the term “superfetch” in relation to XP, although there were several references to it in relation to Longhorn, but those were 1.5 years old.
Have you heard about this?
What is your viewpoint about this?
David, thanks for the pointer. I have never heard of the EnableSuperfetch setting. It certainly sounds like a new feature in Longhorn and if so wouldn’t work in XP. I’ll look into it!
Ed
Thanks, Ed!
I’m interested, if you find anything.
My best,
Dave
From the Microsoft white paper Fast System Startup for PCs Running Windows.doc:
“Prefetching reads pages into memory ahead of demand based on a learned scenario. It is also important for efficient disk I/O for these pages to be contiguous on the hard disk to eliminate excessive seeking. Prefetching and optimized layout result in reduced page faults and efficient disk I/O’s.”
This section of the article is a good summary of what prefetch does … “When the system boots or an application starts, the Cache Manager is called to give it an opportunity to perform
prefetching. The Cache Manager looks in the prefetch directory to see if a trace file exists for the prefetch scenario
in question. If it does, the Cache Manager calls NTFS to prefetch any MFT metadata file references, reads in the
contents of each of the directories referenced, and finally opens each file referenced. It then calls the Memory
Manager to read in any data and code specified in the trace that’s not already in memory. The Memory Manager
initiates all of the reads asynchronously and then waits for them to complete before letting an application’s startup
continue.
How does this scheme provide a performance benefit? The answer lies in the fact that during typical system boot
or application startup, the order of faults is such that some pages are brought in from one part of a file, then from
another part of the same file, then pages are read from a different file, then perhaps from a directory, and so on.
This jumping around results in moving the heads around on the disk. Microsoft has learned through analysis that
this slows boot and application startup times. By prefetching data from a file or directory all at once before
accessing another one, this scattered seeking for data on the disk is greatly reduced or eliminated, thus improving
the overall time for system and application startup.”
According to Microsoft, the prefetch does affect both Windows boot process AND the application startup process. Perhaps this is why there is confusion about how prefetch works and whether or not it affects boot times OR application start times. It affects both.
To more fully understand prefetch, these other articles at Microsoft’s web site were most informative …
Link
Link
Link
Link
By the way, according to Microsoft, if you are benchmarking any prefetch activities, this needs to be done after the THIRD reboot.
Thank you all for an interesting thread.
[Edited to make links clickable. - Ed]
Well, this whole issue has cost me about an hour of time trying to figure out the truth. As several in this thread have mentioned and as the links to MS explain Ed is right, so I won’t post more on that one, but I did want to point out that the mis information is still being spread. This article on windowsnetworking adds to the confusion.
I have gotten good info from windowsnetworking in the past but this article makes me re-think how careful they are.
Thanks,
Tom
[Edited to make link clickable. - Ed]
Ed, Thanks for the information on prefetch.
I did want to point out that the http://arstechnica.com/guides/tweaks/sgp-tweaks.ars/1
article actually suggests that MORE resources be given to the Prefetcher by INCREASING the regkey: [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]
It states that Default is 3, but recommends (with no scientific basis) a setting of 5 or even 9.
Any opinions on this?
Mark,
That article made my head hurt. The accompanying discussion thread does a pretty good job of debunking just about the entire thing!
Thanks for the information on Crap Cleaner-which I unticked.
The next food for thought is weather to untick ”MEMORY DUMPS?”