performing-windows-artifact-analysis-with-eric-zimmerman-tools

What problem does it solve?

Windows forensic investigations require parsing dozens of low-level artifacts like the Master File Table, registry hives, prefetch files, and event logs, each with its own binary format. This Skill guides the use of Eric Zimmerman's EZ Tools suite to collect, parse, and correlate these artifacts into structured CSV output for timeline analysis.

Core Features & Use Cases

• Automated Collection and Processing: Use KAPE to collect triage artifacts from forensic images or live systems and process them with the full EZ Tools parser suite.
• Artifact Parsing: Parse $MFT and USN Journal with MFTECmd, prefetch files with PECmd, registry hives with RECmd, event logs with EvtxECmd, LNK files with LECmd, jump lists with JLECmd, and shellbags with SBECmd.
• Timeline and Anti-Forensics Analysis: Load CSV output into Timeline Explorer to build chronological views and detect timestomping by comparing $STANDARD_INFORMATION and $FILE_NAME timestamps.
• Use Case: During an incident response engagement, collect a KAPE triage image from a compromised workstation, process it with the !EZParser module, and correlate prefetch, Amcache, MFT, and Security 4688 events to prove whether a suspicious binary actually executed.

Quick Start

Use this skill to collect a KAPE triage image from the mounted forensic drive and process it with the EZ Tools parsers for timeline analysis.