In this module
IR1.3 Eric Zimmerman Tools — The Parsing Arsenal
Operational Objective
The Raw Data Problem: KAPE collects the artifacts, but the raw files — binary Prefetch, binary event logs (.evtx), binary registry hives, raw NTFS $MFT — are not human-readable. You cannot open a Prefetch file in Notepad and read which program executed. You cannot open a registry hive in a text editor and find the persistence keys. You cannot scan through a 16 million row $MFT in Excel and find when the attacker created update.exe. Eric Zimmerman Tools (EZTools) parse these binary artifacts into structured CSV, JSON, and timeline formats that you can analyze, search, filter, sort, and correlate. Without EZTools, KAPE output is a folder of opaque binary files. With EZTools, it becomes a searchable investigation dataset organized by evidence category.
Deliverable: The full EZTools suite installed and integrated with KAPE's Modules\bin\ directory, validated with a test parse against the KAPE collection from IR1.2, and understood at operational depth — what each parser extracts, what the output columns mean for the investigation, how to combine outputs into a unified timeline, and how to build automated processing pipelines.
⏱ Estimated completion: 30 minutes
Eric Zimmerman Tools — The Parsing Arsenal
The parsers that turn raw artifacts into investigation answers
KAPE collected the evidence. Now you need to read it. Prefetch files are binary. The $MFT is a binary database. Registry hives are binary structures. Event logs are XML buried in binary wrappers. You cannot open any of these in a text editor and get useful information. Eric Zimmerman's tools — EZTools — parse every one of these formats into structured, searchable, sortable output that you can analyze in Timeline Explorer.
Eric Zimmerman is a former FBI Special Agent, a Senior Director at Kroll, a SANS instructor (FOR508: Advanced Digital Forensics, Incident Response and Threat Hunting), and a three-time winner of the SANS DFIR NetWars Tournament. He has spent over a decade building the most widely used open-source forensic parsing tools in the industry — tools that are now taught in SANS courses, used by government CERT teams and law enforcement agencies worldwide, deployed by the Big 4 consulting firms, and relied upon by thousands of independent DFIR practitioners for every investigation they conduct.
# Step 1: Download the Get-ZimmermanTools script
# Navigate to https://ericzimmerman.github.io/#!index.md
# Download Get-ZimmermanTools.zip and extract to C:\IR\Tools\EZTools\
# Step 2: Run the download script to get ALL EZTools
Set-Location "C:\IR\Tools\EZTools"
.\Get-ZimmermanTools.ps1 -Dest "C:\IR\Tools\EZTools"
# The script downloads the latest version of every tool:
# PECmd, AmcacheParser, AppCompatCacheParser, EvtxECmd,
# MFTECmd, RECmd, Registry Explorer, ShellBags Explorer,
# JLECmd, LECmd, SBECmd, RBCmd, WxTCmd, Timeline Explorer,
# MFTExplorer, EZViewer, SQLECmd, SrumECmd, SumECmd, bstrings,
# Hasher, iisGeoLocate, RLA, and more.
# Step 3: Verify the key tools are present
$criticalTools = @(
"PECmd.exe", # Prefetch parser
"AmcacheParser.exe", # Amcache parser
"AppCompatCacheParser.exe", # ShimCache parser
"EvtxECmd.exe", # Event log parser (THE most important tool)
"MFTECmd.exe", # $MFT, $UsnJrnl, $LogFile parser
"RECmd.exe", # Registry batch processor
"RegistryExplorer.exe", # Registry GUI browser
"ShellBagsExplorer.exe", # ShellBags GUI
"JLECmd.exe", # Jump List parser
"LECmd.exe", # LNK shortcut parser
"SBECmd.exe", # ShellBags command-line
"RBCmd.exe", # Recycle Bin parser
"WxTCmd.exe", # Windows Timeline parser
"TimelineExplorer.exe", # Interactive CSV viewer
"SrumECmd.exe", # SRUM parser
"SQLECmd.exe" # SQLite database parser
)
$found = 0; $missing = 0
foreach ($tool in $criticalTools) {
$path = Get-ChildItem "C:\IR\Tools\EZTools" -Recurse -Filter $tool -ErrorAction SilentlyContinue | Select-Object -First 1
if ($path) {
Write-Host " OK $tool" -ForegroundColor Green
$found++
} else {
Write-Host " MISSING $tool" -ForegroundColor Red
$missing++
}
}
Write-Host "`n$found tools found, $missing missing" -ForegroundColor $(if ($missing -eq 0) { 'Green' } else { 'Red' })# Copy EZTools parser executables to KAPE's Modules\bin\ directory
# This enables KAPE's !EZParser module to find and execute the parsers
$kapeBin = "C:\IR\Tools\KAPE\Modules\bin"
$ezDir = "C:\IR\Tools\EZTools"
# Create bin directory if it doesn't exist
New-Item -ItemType Directory -Path $kapeBin -Force | Out-Null
# Copy all EXE files from EZTools to KAPE bin
# The recursive search handles the nested directory structure
Get-ChildItem $ezDir -Recurse -Filter "*.exe" | ForEach-Object {
Copy-Item $_.FullName -Destination $kapeBin -Force
}
# Also copy the EvtxECmd Maps directory — CRITICAL for event log enrichment
$mapsSource = Get-ChildItem $ezDir -Recurse -Directory -Filter "Maps" | Select-Object -First 1
if ($mapsSource) {
Copy-Item $mapsSource.FullName -Destination "$kapeBin\Maps" -Recurse -Force
Write-Host "EvtxECmd Maps copied: $(
(Get-ChildItem "$kapeBin\Maps" -Recurse -Filter "*.map").Count
) map files" -ForegroundColor Cyan
}
# Verify the integration
$binCount = (Get-ChildItem $kapeBin -Filter "*.exe").Count
Write-Host "KAPE bin directory: $binCount executables ready" -ForegroundColor Green# PECmd: Parse all Prefetch files from a KAPE collection
# Produces CSV with one row per .pf file
PECmd.exe -d "C:\IR\Cases\INC-NE-2026-0315-001\Evidence\C\Windows\Prefetch" --csv "C:\IR\Cases\INC-NE-2026-0315-001\Output\Prefetch" --csvf prefetch.csv -q
# Key output columns and their investigation significance:
#
# ExecutableName — program that ran (e.g., POWERSHELL.EXE-[hash].pf)
# Investigation: what executed? Is this expected on this system?
#
# RunCount — number of times the program has executed
# Investigation: run count of 1 = first execution ever on this system
# A run count of 1 for powershell.exe on a workstation that has been
# in service for months is suspicious — PowerShell should have run
# hundreds of times through normal system operations
#
# LastRun — most recent execution timestamp (UTC)
# Investigation: correlate with sign-in logs and event logs
# to determine who was active when the program ran
#
# PreviousRun0-6 — up to 7 previous execution timestamps
# Investigation: execution pattern — was this a one-time event
# or repeated activity? A hacking tool with 7 run times over
# 3 days suggests persistent attacker activity
#
# SourceFilename — the original .pf filename (includes hash)
# The hash in the filename is based on the full path of the
# executable, meaning the same program from different paths
# produces different Prefetch files
#
# FilesLoaded — DLLs and files referenced during execution
# Investigation: reveals the working directory and any unusual
# DLL loads (side-loading, DLL hijacking)
# Open the output in Timeline Explorer for analysis
TimelineExplorer.exe "C:\IR\Cases\INC-NE-2026-0315-001\Output\Prefetch\prefetch.csv"# EvtxECmd: Parse all event logs from a KAPE collection
# Uses maps to extract and normalize forensically relevant fields
EvtxECmd.exe -d "C:\IR\Cases\INC-NE-2026-0315-001\Evidence\C\Windows\System32\winevt\Logs" --csv "C:\IR\Cases\INC-NE-2026-0315-001\Output\EventLogs" --csvf events.csv -q
# To sync maps to the latest community versions:
EvtxECmd.exe --sync
# This downloads updated map files from the EricZimmerman/evtx GitHub repo
# Key output columns:
#
# TimeCreated — when the event occurred (UTC)
# EventId — the event ID (4624, 4688, 7045, 4104, etc.)
# Provider — which log source (Security, System, PowerShell, etc.)
# Channel — the log file name
# Computer — hostname that generated the event
# MapDescription — human-readable description from the map
# e.g., "Logon - successful" or "Service installed"
#
# PayloadData1-6 — extracted fields specific to each event type
# The map defines what goes into each PayloadData column
# For 4624 logon events: PayloadData1 = TargetUserName,
# PayloadData2 = LogonType, PayloadData3 = IpAddress
# For 7045 service events: PayloadData1 = ServiceName,
# PayloadData2 = ImagePath
#
# UserName — account associated with the event
# RemoteHost — source system (for network logons)# MFTECmd: Parse the $MFT from a KAPE collection
# The backtick (`) escapes the $ in PowerShell
MFTECmd.exe -f "C:\IR\Cases\INC-NE-2026-0315-001\Evidence\C\`$MFT" --csv "C:\IR\Cases\INC-NE-2026-0315-001\Output\Filesystem" --csvf mft.csv -q
# Parse the $UsnJrnl change journal
MFTECmd.exe -f "C:\IR\Cases\INC-NE-2026-0315-001\Evidence\C\`$Extend\`$UsnJrnl:`$J" --csv "C:\IR\Cases\INC-NE-2026-0315-001\Output\Filesystem" --csvf usnjrnl.csv -q
# Key $MFT output columns:
#
# EntryNumber — MFT record number (unique file identifier)
# FileName — file or directory name
# ParentPath — full directory path
# Extension — file extension
# FileSize — size in bytes
# IsDirectory — true/false
#
# TIMESTAMPS (the investigation core):
# Created0x10 — $STANDARD_INFORMATION creation time
# Created0x30 — $FILE_NAME creation time
# LastModified0x10 — last content modification
# LastAccess0x10 — last access time
# LastRecordChange0x10 — last MFT record modification
#
# If Created0x10 ≠ Created0x30, possible timestomping detected
# The $FN (0x30) timestamp is harder to modify than $SI (0x10)
#
# InUse — true = active file, false = deleted (record free)
# Even "false" entries retain the file's metadata — name, path,
# size, timestamps — evidence of what was deleted and when# Open Timeline Explorer with parsed event logs
TimelineExplorer.exe "C:\IR\Cases\INC-NE-2026-0315-001\Output\EventLogs\events.csv"
# Timeline Explorer capabilities for investigation:
#
# Column filtering — click any column header to filter
# Filter EventId to 4624 → shows only logon events
# Filter EventId to 4688 → shows only process creation events
# Filter UserName to "jmorrison" → shows only events for that user
# Combine filters: EventId=4624 AND TimeCreated > 14:00 → logons
# after the suspected compromise time
#
# Date range selection — filter TimeCreated to investigation window
# "Show me everything between 14:00 and 16:00 on March 15"
#
# Text search — search any column for specific values
# Search "powershell" across all columns → finds every event
# mentioning PowerShell regardless of event type
#
# Color coding — highlight rows matching specific criteria
# Red for Event ID 4625 (failed logon) → spot brute force patterns
# Orange for Event ID 7045 (service installed) → spot persistence
# Yellow for Event ID 1102 (log cleared) → spot anti-forensics
#
# Multi-file loading — load multiple CSVs simultaneously
# Load Prefetch + event logs + MFT in one session
# Sort all by timestamp → unified chronological timeline
# across all artifact types
#
# Export — save filtered views to new CSV files
# Export the investigation timeline for the IR report
# Export specific findings for colleague review# RECmd: batch process all registry hives
RECmd.exe --bn "C:\IR\Tools\EZTools\BatchExamples\RECmd_Batch_MC.reb" -d "C:\IR\Cases\INC-NE-2026-0315-001\Evidence" --csv "C:\IR\Cases\INC-NE-2026-0315-001\Output\Registry" --csvf registry.csv -q# Automated EZTools processing pipeline
# Save as: C:\IR\Tools\Scripts\Parse-All.ps1
# Usage: .\Parse-All.ps1 -CasePath "C:\IR\Cases\INC-NE-2026-0315-001"
param(
[Parameter(Mandatory)][string]$CasePath
)
$ez = "C:\IR\Tools\EZTools"
$evidence = "$CasePath\Evidence"
$output = "$CasePath\Output"
New-Item -ItemType Directory -Path $output -Force | Out-Null
Write-Host "=== EZTools Processing Pipeline ===" -ForegroundColor Cyan
Write-Host "Case: $CasePath" -ForegroundColor White
$startTime = Get-Date
# 1. Prefetch → Evidence of Execution
$pfPath = Get-ChildItem $evidence -Recurse -Directory -Filter "Prefetch" | Select-Object -First 1
if ($pfPath) {
& "$ez\PECmd.exe" -d $pfPath.FullName --csv "$output\Prefetch" --csvf prefetch.csv -q
Write-Host " Prefetch: $(
(Import-Csv "$output\Prefetch\prefetch.csv" -ErrorAction SilentlyContinue).Count
) entries" -ForegroundColor Green
}
# 2. Event Logs → Chronological Activity
$evtxPath = Get-ChildItem $evidence -Recurse -Directory -Filter "Logs" |
Where-Object { $_.FullName -like "*winevt*" } | Select-Object -First 1
if ($evtxPath) {
& "$ez\EvtxECmd.exe" -d $evtxPath.FullName --csv "$output\EventLogs" --csvf events.csv -q
Write-Host " Event Logs: $(
(Import-Csv "$output\EventLogs\events.csv" -ErrorAction SilentlyContinue).Count
) entries" -ForegroundColor Green
}
# 3. Amcache → Execution with Hashes
$amcache = Get-ChildItem $evidence -Recurse -Filter "Amcache.hve" | Select-Object -First 1
if ($amcache) {
& "$ez\AmcacheParser.exe" -f $amcache.FullName --csv "$output\Amcache" --csvf amcache.csv -q
Write-Host " Amcache: DONE" -ForegroundColor Green
}
# 4. $MFT → Filesystem Timeline
$mft = Get-ChildItem $evidence -Recurse -Filter '$MFT' -ErrorAction SilentlyContinue | Select-Object -First 1
if ($mft) {
& "$ez\MFTECmd.exe" -f $mft.FullName --csv "$output\Filesystem" --csvf mft.csv -q
Write-Host " MFT: $(
(Import-Csv "$output\Filesystem\mft.csv" -ErrorAction SilentlyContinue).Count
) entries" -ForegroundColor Green
}
# 5. Registry Batch → Persistence, User Activity, System Config
& "$ez\RECmd.exe" --bn "$ez\BatchExamples\RECmd_Batch_MC.reb" -d $evidence --csv "$output\Registry" --csvf registry.csv -q 2>$null
Write-Host " Registry: DONE" -ForegroundColor Green
# 6. ShellBags → Folder Navigation
$usrclass = Get-ChildItem $evidence -Recurse -Filter "UsrClass.dat" -ErrorAction SilentlyContinue
foreach ($uc in $usrclass) {
$user = $uc.Directory.Parent.Name
& "$ez\SBECmd.exe" -d $uc.DirectoryName --csv "$output\ShellBags" --csvf "shellbags_$user.csv" -q 2>$null
}
Write-Host " ShellBags: DONE" -ForegroundColor Green
$elapsed = (Get-Date) - $startTime
Write-Host "`n=== Pipeline complete in $([math]::Round($elapsed.TotalMinutes, 1)) minutes ===" -ForegroundColor Cyan
Write-Host "Output: $output" -ForegroundColor White
Write-Host "Next: Open CSV files in Timeline Explorer for analysis" -ForegroundColor WhiteCompliance Myth
"You need EnCase or FTK to do real forensics."
Production reality: EnCase and FTK are comprehensive commercial forensic platforms with integrated case management, built-in reporting, and workflow automation. They are excellent tools for law enforcement labs that manage hundreds of cases and need chain-of-custody tracking integrated into the analysis platform. But the underlying forensic analysis — parsing Prefetch, reading event logs, analyzing registry hives, building MFT timelines — is identical whether performed by EnCase at $3,000/license or EZTools at $0. Eric Zimmerman's tools are taught in SANS FOR500 and FOR508 — the gold-standard DFIR courses. They are used by the FBI, by Kroll's own IR teams, and by government CERTs that have access to any commercial tool they want and choose EZTools for their depth, accuracy, and speed. The difference between EZTools and commercial suites is the workflow wrapper (case management, integrated reporting) — not the forensic capability. This course teaches the forensic capability.
Build it: Parse your KAPE collection and explore the output
Run the Parse-All
Run the Parse-All.ps1 script against your KAPE test collection from IR1.2. Open the Prefetch CSV in Timeline Explorer and find powershell.exe — note its run count and last execution time. Open the event logs CSV and filter to EventId 4624 — find your most recent logon. Open the MFT CSV and filter to the last 24 hours — find files you recently created or downloaded. Each of these is a finding you would document in an IR report. The data is from your own clean system, but the analysis workflow is identical to what you will use on a compromised system in IR3-IR5.
Investigate: What do EvtxECmd Maps add?
Run EvtxECmd twice against the same event log file: once with maps (the default, using the Maps directory) and once without (rename the Maps directory temporarily). Compare the output. Without maps, the PayloadData columns contain raw XML fragments. With maps, they contain extracted, named fields — TargetUserName, LogonType, IpAddress. The maps transform raw data into investigation-ready evidence. This is why syncing maps (EvtxECmd.exe --sync) before every investigation matters — new maps are added for newly discovered event types and forensic artifacts.
Beyond this investigation
The techniques taught in this subsection apply beyond the specific scenario presented here. The same evidence sources, tools, and analytical methods are used across ransomware, BEC, insider threat, and APT investigations — the context changes but the methodology is consistent.
Decision point
You discover evidence that the attacker has been in the environment for 90 days. The CISO asks: 'Why did our SOC not detect this sooner?' How do you answer constructively?
Answer with facts, not defensiveness. 'The attacker used [specific techniques] that our current detection rules do not cover. The investigation identified [N] detection gaps — [list the specific ATT&CK techniques that were not detected]. The IR-to-DE handoff includes these gaps as detection engineering sprint items. Estimated time to close: [N weeks].' This answer is honest (we missed it), specific (here is what we missed and why), and forward-looking (here is how we fix it). The PIR action items transform the detection failure into a measurable improvement program.
© 2026 Ridgeline Cyber Defence™ Ltd. Content may not be reproduced or redistributed. Worked artifacts may be adapted for use within your organization.