Eric Zimmerman's Tools

Eric Zimmerman publishes these tools on his own site, where he says their open source development is funded by the SANS Institute. Each one does a single job. Registry Explorer and its command line twin RECmd read hives with plugins and search across several hives, and RLA replays transaction logs so a hive is current before it is read. MFTECmd parses the master file table and the other NTFS metadata files and MFTExplorer shows the table in a window. EvtxECmd turns event logs into CSV, XML or JSON using community maps. PECmd reads prefetch, LECmd reads shortcut files, JLECmd and JumpList Explorer read jump lists, SBECmd and ShellBags Explorer read shellbags, AmcacheParser and AppCompatCacheParser read the two program execution caches, RBCmd reads the recycle bin, SrumECmd reads the system resource usage database, SumECmd reads user access logs, WxTCmd reads the Windows timeline database and SQLECmd reads SQLite files with maps. Timeline Explorer opens the resulting CSV and Excel files with filtering and grouping. Smaller helpers include bstrings, Hasher, VSCMount, EZViewer, SDB Explorer, iisGeolocate, TimeApp and XWFIM.

The site states the runtime for each tool. Command line tools are built for Microsoft .NET Framework 4.7.2 and for .NET 10, with a few on .NET 10 only, and the graphical tools need the .NET 10 Desktop runtime. Every download is digitally signed and a PowerShell script, Get-ZimmermanTools, fetches and updates the whole set. The tools are the usual payload of KAPE modules, but they are just as often run by hand against files copied out of an image. Several of them read files that Windows has locked, which makes live triage possible. The output is raw and the examiner still has to know what it means: a prefetch entry shows that a program ran at a time, not who sat at the keyboard.