Eric Zimmerman's tools (EZ Tools)
Eric Zimmerman · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Who it is for, and when
These are the reference parsers for Windows artefacts: if you need the $MFT, prefetch, LNK files, jump lists, Amcache, shellbags, or EVTX records turned into CSV you can defend, this is the set practitioners actually use. Output is designed to land in Timeline Explorer, which makes filtering a few million rows practical. They are also the backbone of KAPE's module layer, so KAPE output and EZ Tools output are the same output.
What it does not cover
These are parsers, not a platform — there is no case management, no image mounting, no acquisition, and no cross-artefact correlation beyond what you build yourself in a spreadsheet or Timeline Explorer. They are Windows-artefact tools and will not help with macOS, Linux, or mobile data, and each tool assumes you already have the artefact file extracted.
Go to the source
Open at ericzimmerman.github.io (opens in a new tab)https://ericzimmerman.github.io/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Eric Zimmerman
- Year
- 2026
- Topics
- windows, registry, timeline, triage, log-analysis, open-source
- Checked at source
Related entries
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
An artifact-by-artifact working guide to Windows examination: Volume Shadow Copies, file metadata, registry analysis, malware detection on a dead box, timeline construction and artifact correlation. Written as a bench manual rather than a textbook.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
RegRipper
FreeAn open-source Perl tool that runs a library of plugins against Windows registry hives and reports the values that matter forensically, with each plugin documenting the key it read. RegRipper 3.0 is the current line and the repository remains actively updated.