Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry hives, prefetch files, event logs, and file system metadata.
Perform comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite including KAPE, MFTECmd, PECmd, LECmd, JLECmd, and Timeline Explorer for parsing registry hives, prefetch files, event logs, and file system metadata.
Performing Windows Artifact Analysis with Eric Zimmerman Tools
Overview
Eric Zimmerman's EZ Tools suite is a collection of open-source forensic utilities that have become the global standard for Windows digital forensics investigations. Originally developed by a former FBI agent and current SANS instructor, these tools parse and analyze critical Windows artifacts including the Master File Table ($MFT), registry hives, prefetch files, event logs, shortcut (LNK) files, and jump lists. The suite integrates with KAPE (Kroll Artifact Parser and Extractor) for automated artifact collection and processing, producing structured CSV output that can be ingested into Timeline Explorer for visual analysis. EZ Tools are widely used by law enforcement, corporate incident responders, and forensic consultants worldwide.
When to Use
When conducting security assessments that involve performing windows artifact analysis with eric zimmerman tools
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Detection Gaps & Validation
EZ Tools parse what is present in the artifact; they do not tell you what was rolled, disabled, or never recorded. Account for these:
Artifacts are finite and get pruned. Prefetch holds only the last ~1024 executions (and is off by default on Servers/SSDs in some configs), so PECmd showing no entry for a binary is not proof it never ran. Amcache/SOFTWARE, ShimCache (AppCompatCache), and BAM/DAM give independent execution evidence — correlate all of them rather than trusting one. EVTX channels roll by size; the incident may predate the oldest .evtx.
Timestomping defeats the easy timestamps. MFTECmd surfaces $STANDARD_INFORMATION times that malware backdates; always compare Created0x10 vs Created0x30 ($SI vs $FN) — when $SI predates $FN, suspect manipulation. $FN times resist user-mode stomping but aren't immutable. Corroborate file creation with the USN Journal ($J), which records the rename/create operations themselves.
Deleted and overwritten records. A deleted EVTX, a cleared log (Event ID 1102/104), or an InUse=false MFT record means EvtxECmd/MFTECmd will show gaps, not activity. Recover from Volume Shadow Copies and carve unallocated space before scoping; flag clears explicitly as anti-forensics.
Validate by cross-referencing tools. A real execution should line up across PECmd (Prefetch), Amcache (hash + path via RECmd), MFT ($MFT creation), and Security 4688/Sysmon 1. A claim supported by only one artifact is a lead, not a conclusion. Hash-match suspect binaries before labeling them malicious.
Interpretation false positives. Prefetch/ShimCache prove a program existed/was referenced — ShimCache entries in particular do NOT prove execution, only presence. LNK and JumpList entries can be created by automated/recent-docs activity, not deliberate opens. Shellbags show a folder was browsed at some point, not when or by whom. Confirm operator intent with surrounding artifacts and timezone-normalized timelines.
Prerequisites
Windows 10/11 or Windows Server 2016+ analysis workstation
.NET 6 Runtime installed (required for EZ Tools v2.x+)
Administrative privileges on the analysis workstation
Forensic disk image or triage collection from target system
At least 8 GB RAM (16 GB recommended for large datasets)
Familiarity with NTFS file system structures and Windows internals
Tool Suite Components
KAPE (Kroll Artifact Parser and Extractor)
KAPE is the primary orchestration tool that automates artifact collection (Targets) and processing (Modules). It uses configuration files (.tkape and .mkape) to define what artifacts to collect and which EZ Tools to run against them.
Installation and Setup:
# Download KAPE from https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape
# Extract to C:\Tools\KAPE
# Update KAPE targets and modules
C:\Tools\KAPE\gkape.exe # GUI version
C:\Tools\KAPE\kape.exe # CLI version
# Sync latest EZ Tools binaries
C:\Tools\KAPE\Get-KAPEUpdate.ps1
Running KAPE Collection and Processing:
# Collect artifacts from E: drive (mounted forensic image) and process with EZ Tools
kape.exe --tsource E: --tdest C:\Cases\Case001\Collection --target KapeTriage --mdest C:\Cases\Case001\Processed --module !EZParser
# Collect specific artifact categories
kape.exe --tsource E: --tdest C:\Cases\Case001\Collection --target FileSystem,RegistryHives,EventLogs --mdest C:\Cases\Case001\Processed --module MFTECmd,RECmd,EvtxECmd
# Live system triage collection (run as administrator)
kape.exe --tsource C: --tdest D:\LiveTriage\Collection --target KapeTriage --mdest D:\LiveTriage\Processed --module !EZParser --vhdx LiveTriageImage
MFTECmd - Master File Table Parser
MFTECmd parses the NTFS $MFT, $J (USN Journal), $Boot, $SDS, and $LogFile into human-readable CSV format.
PECmd parses Windows Prefetch files (.pf) to provide evidence of program execution, including run counts and timestamps.
# Parse all prefetch files from a directory
PECmd.exe -d "C:\Cases\Evidence\Windows\Prefetch" --csv C:\Cases\Output --csvf Prefetch_output.csv
# Parse a single prefetch file with verbose output
PECmd.exe -f "C:\Cases\Evidence\Windows\Prefetch\CMD.EXE-4A81B364.pf" --json C:\Cases\Output
# Parse prefetch with keyword filtering
PECmd.exe -d "C:\Cases\Evidence\Windows\Prefetch" -k "powershell,cmd,wscript,cscript,mshta" --csv C:\Cases\Output --csvf SuspiciousExec.csv
RECmd - Registry Explorer Command Line
RECmd processes Windows registry hives using batch files that define which keys and values to extract.
# Process all registry hives with the default batch file
RECmd.exe --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb -d "C:\Cases\Evidence\Registry" --csv C:\Cases\Output --csvf Registry_output.csv
# Process a single NTUSER.DAT hive
RECmd.exe -f "C:\Cases\Evidence\Users\suspect\NTUSER.DAT" --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb --csv C:\Cases\Output
# Process SYSTEM hive for USB device history
RECmd.exe -f "C:\Cases\Evidence\Registry\SYSTEM" --bn C:\Tools\KAPE\Modules\bin\RECmd\BatchExamples\RECmd_Batch_MC.reb --csv C:\Cases\Output
EvtxECmd - Windows Event Log Parser
EvtxECmd parses Windows Event Log (.evtx) files into structured CSV format with customizable event ID maps.
# Parse all event logs from a directory
EvtxECmd.exe -d "C:\Cases\Evidence\Windows\System32\winevt\Logs" --csv C:\Cases\Output --csvf EventLogs_output.csv
# Parse a single event log
EvtxECmd.exe -f "C:\Cases\Evidence\Security.evtx" --csv C:\Cases\Output --csvf Security_output.csv
# Parse with custom maps for enhanced field extraction
EvtxECmd.exe -d "C:\Cases\Evidence\Logs" --csv C:\Cases\Output --maps C:\Tools\KAPE\Modules\bin\EvtxECmd\Maps
# Parse shellbags from a directory of registry hives
SBECmd.exe -d "C:\Cases\Evidence\Registry" --csv C:\Cases\Output --csvf Shellbags_output.csv
# Parse shellbags from a live system (requires admin)
SBECmd.exe --live --csv C:\Cases\Output --csvf LiveShellbags_output.csv
Timeline Explorer - Visual Analysis
Timeline Explorer is the GUI tool for analyzing CSV output from all EZ Tools. It supports filtering, sorting, column grouping, and conditional formatting.
# Launch Timeline Explorer and open CSV output
TimelineExplorer.exe "C:\Cases\Output\MFT_output.csv"
Key Timeline Explorer Features:
Column-level filtering with regular expressions
Conditional formatting for timestamp anomalies
Multi-column sorting for chronological analysis
Export filtered results to new CSV files
Bookmarking rows of interest
Investigation Workflow
Step 1: Artifact Collection with KAPE
# Full triage collection from forensic image mounted at E:
kape.exe --tsource E: --tdest C:\Cases\Case001\Collected --target KapeTriage --vhdx TriageImage --zv false
Step 2: Artifact Processing with EZ Tools
# Process all collected artifacts
kape.exe --msource C:\Cases\Case001\Collected --mdest C:\Cases\Case001\Processed --module !EZParser
Step 3: Timeline Analysis
Open processed CSV files in Timeline Explorer
Sort by timestamp columns to establish chronological order
Filter for specific file extensions, paths, or event IDs
Cross-reference MFT timestamps with event log entries
Identify timestomping by comparing $SI and $FN timestamps
Document findings with bookmarks and exported filtered views
Step 4: Timestomping Detection
# In Timeline Explorer, compare these columns:
# Created0x10 ($STANDARD_INFORMATION) vs Created0x30 ($FILE_NAME)
# If Created0x10 < Created0x30, timestomping is indicated
# $FILE_NAME timestamps are harder to manipulate than $STANDARD_INFORMATION
