domains / families / security / parsing-artifacts-with-eric-zimmerman-tools

parsing-artifacts-with-eric-zimmerman-tools

separate

Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.

When to use

• After triage collection (e.g. with KAPE) when you need to parse raw artifacts into structured, searchable evidence.
• To establish program execution, file/folder access, and persistence during incident response.
• To build artifact-specific CSVs that feed timelines, Timesketch, or SIEM ingestion.

Skill page

Source