Eric Zimmerman Tools

Primary Use Case

Tool Collection

Secondary Use Case

Tool Type

Standalone Tool

Cost Model

Free

Developer

Eric Zimmerman Tools

Visit Website

https://ericzimmerman.github.io/#!index.md

Eric Zimmerman Tools is a widely used collection of Windows forensic utilities focused on artifact parsing, registry analysis, event log review, timeline work, shell item analysis, file system metadata, and rapid evidence collection. This page is designed so searches for either a specific tool name or a forensic task can find the collection.

Core forensic tools in this collection include:

AmcacheParser — Parses Amcache.hve data to identify executed programs, application metadata, and related execution artifacts.

AppCompatCacheParser — Parses AppCompatCache / ShimCache data to identify historical program execution-related evidence.

bstrings — Extracts strings and supports built-in regular expression patterns for artifact review, keyword hunting, and data inspection.

EvtxECmd — Parses Windows EVTX event logs and exports structured output for event log analysis, filtering, correlation, and reporting.

EZViewer — Provides a standalone viewer for common document, text, log, spreadsheet, HTML, CSV, and PDF files during forensic review.

Hasher — Calculates file and folder hashes for validation, integrity checking, and comparison workflows.

JLECmd — Parses Windows Jump Lists to help reconstruct file access, application usage, and user activity.

JumpList Explorer — Graphical Jump List viewer for examining recent file and application usage artifacts.

LECmd — Parses Windows LNK shortcut files to identify opened files, target paths, volumes, and user activity.

MFTECmd — Parses NTFS file system artifacts including the $MFT and related metadata sources for file system timeline and metadata analysis.

MFTExplorer — Graphical viewer for browsing and analyzing $MFT data.

PECmd — Parses Windows Prefetch files to identify application execution history and execution context.

RBCmd — Parses Recycle Bin artifacts, including INFO2 and $I metadata, to identify deleted file activity.

RecentFileCacheParser — Parses RecentFileCache artifacts to identify recently referenced files.

RECmd — Command-line Registry analysis tool with searching, multi-hive support, batch processing, and plugin support.

Registry Explorer — Graphical Registry viewer with search, multi-hive support, and plugin-assisted registry analysis.

RLA — Replays Registry transaction logs to update dirty hives so they can be examined more accurately.

SDB Explorer — Graphical viewer for Windows Shim Database files.

SBECmd — Command-line ShellBags parser for exporting folder browsing and shell item data.

ShellBags Explorer — Graphical ShellBags viewer for examining folder navigation and shell item history.

SQLECmd — Finds and processes SQLite databases using maps, helping analyze application databases and other SQLite-backed artifacts.

SrumECmd — Parses SRUDB.dat and related data to examine network usage, process activity, and energy-related telemetry.

SumECmd — Parses Microsoft User Access Logging data for Windows server and system usage review.

Timeline Explorer — Opens and works with CSV and Excel data for timeline analysis, filtering, grouping, sorting, and investigation review.

VSCMount — Mounts Volume Shadow Copies to support examination of historical file system states.

WxTCmd — Parses the Windows Timeline database to reconstruct user activity history.

Additional tools listed on the official index include:

Get-ZimmermanTools — PowerShell utility for downloading, updating, and maintaining the full Zimmerman tool set.

iisGeoLocate — Extracts IP addresses from IIS logs and geolocates them for web log review and incident response work.

KAPE — High-speed artifact collection and processing tool used for triage, targeted collection, and rapid forensic acquisition.

TimeApp — Simple utility for viewing current local time, UTC time, and optionally public IP information during testing or validation.

XWFIM — X-Ways Forensics installation manager utility.

Best for: Windows artifact parsing, registry analysis, event log analysis, Jump List review, LNK analysis, Prefetch analysis, ShellBags analysis, MFT review, timeline analysis, Volume Shadow Copy review, and rapid forensic collection workflows.

Eric Zimmerman Tools is a widely used collection of free Windows forensic utilities focused on parsing, viewing, collecting, and correlating high-value Windows artifacts for investigations.