Eric Zimmerman Tools¶

What EZ Tools provide¶

Windows artefact parsing and review

Eric Zimmerman's tools are a maintained collection of focused Windows forensic parsers and viewers. SUSA uses command-line parsers for reproducible extraction and GUI viewers for targeted inspection; no single output should be treated as proof without source provenance and corroboration.

Execution-related sources
AmcacheParser, AppCompatCacheParser and PECmd expose different records with different evidential meanings.
Event records
EvtxECmd converts EVTX into reviewable CSV, JSON or XML while preserving event context.
Interactive viewers
ShellBags Explorer, JumpList Explorer and SDB Explorer support focused visual examination.

Choose your journey¶

01Install and update

Install required runtimes, retrieve signed packages and record versions.

Complete when the toolset is attributable and repeatable.Beginner · 25–40 min 02Command-line parsers

Parse Amcache, ShimCache, Prefetch and EVTX sources with bounded conclusions.

Complete when output remains linked to source and command.Practical · 35–55 min 03GUI artefact viewers

Open ShellBag, Jump List and SDB evidence in their focused interfaces.

Complete when the observation and limitations are recorded.Practical · 25–40 min 04Hands-on Labs

Practise a parser or viewer, then correlate several sources in the Full Lab.

Complete when the finding is reproducible.Guided · 25–110 min

Evidence workflow¶

1 Ask›2 Preserve source›3 Select tool›4 Parse and review›5 Corroborate

Parser output is derived evidence

Retain the original artefact, exact executable version, command, settings, warnings and output hashes. Presence in Amcache or ShimCache does not by itself prove execution; interpret each source according to its behaviour.