Eric Zimmerman Tools & KAPE

Eric Zimmerman’s tools (“EZ Tools”) are the free, open-source parsers that SANS FOR500 and most DFIR modules are built on: one small command-line tool per Windows artefact, all producing the same flat CSV that drops straight into Timeline Explorer. KAPE (Kroll Artifact Parser and Extractor) is the collector and orchestrator that sits in front of them: it copies the artefacts off a live box or mounted image in minutes (targets), then runs the parsers over the copy (modules). Learn the pattern once — tool -f <artefact> --csv <out> — and you know the whole suite. This card is the install, the KAPE triage command you will run on every case, then each parser with what it reads and what question it answers.

[!info] Where they come from Everything here is at ericzimmerman.github.io (tools) and kroll.com/kape (KAPE, free for non-commercial / internal use, registration required). Builds ship for .NET 6 and .NET 9; grab the one matching the runtime on your analysis box. The .NET 4 builds are gone.

Install and update

# One script pulls every tool (and keeps them updated — rerun it monthly)
Set-ExecutionPolicy Bypass -Scope Process
iwr https://raw.githubusercontent.com/EricZimmerman/Get-ZimmermanTools/master/Get-ZimmermanTools.ps1 -OutFile Get-ZimmermanTools.ps1
.\Get-ZimmermanTools.ps1 -Dest C:\Tools\EZ -NetVersion 9        # or -NetVersion 6

# Runtime the tools need
winget install Microsoft.DotNet.DesktopRuntime.9                # GUI tools (Registry/Timeline/ShellBags Explorer)
winget install Microsoft.DotNet.Runtime.9                       # CLI tools

# KAPE lives separately (download from Kroll, unzip anywhere — it is portable)
#   C:\Tools\KAPE\kape.exe      CLI
#   C:\Tools\KAPE\gkape.exe     GUI that builds the CLI command for you
# Point KAPE at the EZ tools once: copy them into C:\Tools\KAPE\Modules\bin\
Copy-Item C:\Tools\EZ\net9\*.exe C:\Tools\KAPE\Modules\bin\ -Force
# Update KAPE's targets/modules from the community repo
C:\Tools\KAPE\kape.exe --sync

Add C:\Tools\EZ\net9 to PATH and every example below works as written. Every tool answers --help; the --csv output flag and -q (quiet) are common to almost all.

[!tip] Linux / macOS analyst box The CLI tools run under the Linux .NET runtime too (dotnet MFTECmd.dll ..., or the native builds the script fetches with -NetVersion 9). The GUI tools (Timeline Explorer, Registry Explorer) are Windows-only — keep a Windows VM for those, or use xsv/qsv/visidata on the CSVs.

The mental model

                 collect                          parse                          review
 live box  ──►  KAPE --target  ──►  copy of artefacts  ──►  KAPE --module / *Cmd  ──►  CSV  ──►  Timeline Explorer
 or image        (files only,        (tree mirrors C:\,     (MFTECmd, PECmd, ...)         (one per artefact)   (filter, tag,
                 timestamps kept)     or a VHDX)                                                                  pivot on time)

KAPE

The triage command you will actually run

:: Live box, collecting from C:, output to your USB (E:), then parse everything
kape.exe --tsource C: --tdest E:\case042\tout --target !SANS_Triage --tflush ^
         --msource E:\case042\tout --mdest E:\case042\mout --module !EZParser --mflush ^
         --gui

:: Same, but pack the collection into a VHDX (one file, keeps ACLs/timestamps, mounts anywhere)
kape.exe --tsource C: --tdest E:\case042\tout --target KapeTriage --vhdx HOST-042 --zv false

:: From a mounted image instead of a live box (F: is the mounted E01 / Arsenal Image Mounter letter)
kape.exe --tsource F: --tdest E:\case042\tout --target !SANS_Triage --tflush

:: Only parse an existing collection (you already ran the target, or someone sent you a triage zip)
kape.exe --msource E:\case042\tout --mdest E:\case042\mout --module !EZParser --mflush

[!warning] Footprint and what KAPE is not KAPE running on a live box creates artefacts (prefetch entry, kape.exe in Amcache/ShimCache, a ConsoleHost history line). Note the time you started it and exclude it in the timeline. It also pulls locked files ($MFT, hives, $UsnJrnl) through raw disk reads — it is not a bit-for-bit image and never will be; if you need one, image first.

Targets worth knowing

kape.exe --tlist                    :: everything
kape.exe --tdetail !SANS_Triage     :: exactly which .tkape files a compound target includes
type "C:\Tools\KAPE\Targets\Compound\!SANS_Triage.tkape"

Modules worth knowing

gkape (GUI)

Tick Use Target options, pick source/destination, tick targets in the tree (search box top right), tick Use Module options, pick !EZParser, and read the command line box at the bottom — that is the exact CLI it will run. Copy it into your notes; gkape is a command builder, nothing more.

The parsers, one artefact at a time

Every EZ CLI tool accepts -f <file> or -d <directory>, --csv <outdir> (add --csvf name.csv to fix the filename), --json <outdir>, -q to suppress per-record console output, --dt "yyyy-MM-dd HH:mm:ss.fffffff" to change the timestamp format, and --debug. Timestamps are UTC unless you pass --tz. Paths below assume a KAPE collection under E:\case042\tout\C\.

MFTECmd — $MFT, $J (USN journal), $LogFile, $Boot, $SDS

Every file that ever existed (until the record is reused), with all eight timestamps. The backbone of any timeline.

:: Parse the MFT — one row per file/dir, $STANDARD_INFORMATION and $FILE_NAME timestamps side by side
MFTECmd.exe -f "E:\case042\tout\C\$MFT" --csv E:\case042\mout\mft --csvf mft.csv

:: Include the $FILE_NAME-only timestamps too (timestomp detection) and the resident data / ADS
MFTECmd.exe -f "$MFT" --csv out --fl --at

:: Bodyfile for mactime / plaso (drive letter for the paths)
MFTECmd.exe -f "$MFT" --body out --bodyf mft.body --bdl C

:: One entry in full detail (entry number 0x1A5 or decimal), including data runs
MFTECmd.exe -f "$MFT" --de 421
MFTECmd.exe -f "$MFT" --de 421 --dr

:: USN journal: what happened to files (create/delete/rename/overwrite) with the MFT to resolve full paths
MFTECmd.exe -f "E:\case042\tout\C\$Extend\$J" -m "E:\case042\tout\C\$MFT" --csv out --csvf usn.csv

:: $LogFile (NTFS transaction log) and $Boot / $SDS (security descriptors)
MFTECmd.exe -f "$LogFile" --csv out
MFTECmd.exe -f "$Boot"    --csv out
MFTECmd.exe -f "$SDS"     --csv out

:: Pull from volume shadow copies too (needs --vss and admin, live or mounted image)
MFTECmd.exe -f "F:\$MFT" --csv out --vss

[!tip] Reading the MFT CSV in Timeline Explorer Created0x10 / LastModified0x10 etc. are $STANDARD_INFORMATION (what Explorer shows, user-space tools can change these). Created0x30 etc. are $FILE_NAME (kernel-set, much harder to fake). Filter SI<FN = true to find files whose visible timestamps predate their filename record — classic timestomping. InUse = false → deleted but record not yet reused. HasAds → alternate data streams; ZoneIdContents gives the download URL from Zone.Identifier.

PECmd — Prefetch (C:\Windows\Prefetch\*.pf)

Which executables ran, when (last 8 run times on Win8+), how many times, and which files/volumes they touched in the first ~10 s.

PECmd.exe -d "E:\case042\tout\C\Windows\Prefetch" --csv out -q
PECmd.exe -f "E:\case042\tout\C\Windows\Prefetch\MIMIKATZ.EXE-1A2B3C4D.pf"
PECmd.exe -d Prefetch --csv out -k "temp,appdata,downloads,users\\public"   :: highlight rows whose loaded files match keywords
PECmd.exe -d Prefetch --csv out --vss                                       :: shadow copies too
PECmd.exe -d Prefetch --json out

Output is two CSVs: *_PECmd_Output.csv (one row per .pf: exe, run count, last run + 7 previous, volume serials) and *_PECmd_Output_Timeline.csv (one row per run, ready to merge into a timeline). Hash in the filename changes with the path the exe ran from — two CMD.EXE-xxxx.pf files = cmd launched from two locations. Prefetch is off by default on servers and SSD-tuned boxes; check HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnablePrefetcher before concluding “never ran”.

LECmd — LNK shortcut files

Files the user opened (Recent), with the target’s path, size, timestamps, volume serial, and the MAC address / hostname of the machine the LNK was made on.

LECmd.exe -d "E:\case042\tout\C\Users\bob\AppData\Roaming\Microsoft\Windows\Recent" --csv out -q
LECmd.exe -d "E:\case042\tout\C\Users" --csv out -q --all       :: every .lnk under every profile (Desktop, Start Menu, ...)
LECmd.exe -f suspicious.lnk --mp                                :: more precise timestamps; also dumps the full structure
LECmd.exe -d Recent --csv out --neb                             :: include LNKs with no TargetIDList/ExtraBlocks (rare edge cases)

TargetCreated/TargetModified/TargetAccessed are the target file’s timestamps at LNK creation; SourceCreated/Modified are the LNK’s own = first/last time the file was opened. MachineID/MacAddress place a USB-carried LNK on a specific host. Phishing LNKs: check Arguments for powershell -enc, and WorkingDirectory.

JLECmd — Jump Lists (Automatic + Custom Destinations)

Per-application recent items — Word documents, RDP hosts (mstsc), Explorer folders — surviving longer than Recent LNKs.

JLECmd.exe -d "E:\case042\tout\C\Users\bob\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv out -q
JLECmd.exe -d "...\Recent\CustomDestinations" --csv out -q
JLECmd.exe -d Recent --csv out -q --ld                :: include full LNK detail per entry
JLECmd.exe -d Recent --csv out -q --withDir           :: dump the embedded LNKs to disk
JLECmd.exe -f "5f7b5f1e01b83767.automaticDestinations-ms" --fd     :: full dump of one list

The filename hash is the AppID: 5f7b5f1e01b83767 = Quick Access, 9b9cdc69c1c24e2b = Notepad, f01b4d95cf55d32a = Explorer, 1b4dd67f29cb1962 = Windows Explorer pinned. JLECmd resolves the known ones for you (AppIdDescription column). RDP jump list (mstsc.exe, {...}) lists every hostname/IP the user connected to.

EvtxECmd — Event logs (.evtx)

The normalised event log view: every EVTX in one CSV with a MapDescription and a PayloadData1..6 extraction of the fields that matter (user, IP, process, service name), courtesy of community maps.

:: Update the maps first — they turn raw XML into "Logon: user X from IP Y"
EvtxECmd.exe --sync

:: All logs from a collection
EvtxECmd.exe -d "E:\case042\tout\C\Windows\System32\winevt\Logs" --csv out --csvf evtx.csv

:: Only the IDs you care about, in a date window
EvtxECmd.exe -d Logs --csv out --inc 4624,4625,4634,4648,4672,4688,4698,4720,4732,7045,1102 ^
             --sd "2026-09-20 00:00:00" --ed "2026-09-27 00:00:00"

:: Exclude noise
EvtxECmd.exe -d Logs --csv out --exc 5156,5158,4689

:: Single log, JSON for jq / SIEM ingestion
EvtxECmd.exe -f Security.evtx --json out
EvtxECmd.exe -f Security.evtx --xml out                 :: original XML per event

:: Live system (admin)
EvtxECmd.exe -d C:\Windows\System32\winevt\Logs --csv E:\case042\live-evtx --vss

Key columns: TimeCreated, EventId, Channel, Computer, UserId, MapDescription, PayloadData1-6 (mapped fields), RemoteHost, ExecutableInfo, Payload (full XML). Sort by time, filter MapDescription — this is how you find the 4624 type 10 from the odd IP in minutes. The Event ID table lives in the Digital Forensics reference. For Sigma-rule detection over the same files use Hayabusa / Chainsaw (KAPE modules exist for both).

AmcacheParser — Amcache.hve

Every executable and driver the system inventoried — full path, SHA-1 of the first 31 MB, publisher, compile time, first-seen time. Survives the binary being deleted.

AmcacheParser.exe -f "E:\case042\tout\C\Windows\appcompat\Programs\Amcache.hve" --csv out
AmcacheParser.exe -f Amcache.hve --csv out -i          :: include only unassociated file entries (executables not tied to an installed program) — the malware view
AmcacheParser.exe -f Amcache.hve --csv out -w known-good.txt   :: whitelist of SHA-1s to drop
AmcacheParser.exe -f Amcache.hve --csv out -b iocs.txt          :: blacklist: flag matches

Outputs several CSVs: *_UnassociatedFileEntries (the interesting one), *_AssociatedFileEntries, *_ProgramEntries, *_DriverBinaries, *_ShortCuts, *_DeviceContainers/*_DevicePnps (USB devices!). FileKeyLastWriteTimestamp ≈ first execution / first seen (not exact). Throw the SHA-1 column at VirusTotal.

AppCompatCacheParser — ShimCache (SYSTEM hive)

Executables that were present (and usually run) — path + $SI modification time, in insertion order. No run count, no run time, but it records binaries Prefetch never saw (servers).

AppCompatCacheParser.exe -f "E:\case042\tout\C\Windows\System32\config\SYSTEM" --csv out
AppCompatCacheParser.exe -f SYSTEM --csv out -t         :: sort by insertion order (most recent first) — the "what ran last" view
AppCompatCacheParser.exe -f SYSTEM --csv out -c 1       :: specific ControlSet
AppCompatCacheParser.exe --csv out                      :: live system

LastModifiedTimeUTC is the file’s modification time, not execution. CacheEntryPosition 0 = most recently inserted. Written to the hive only at shutdown/reboot — a live box’s cache is in memory (Volatility windows.shimcachemem). Executed flag exists only on Win7/8 formats.

SBECmd / ShellBags Explorer — ShellBags (NTUSER.DAT, UsrClass.dat)

Folders the user browsed in Explorer — including on USB drives, network shares, zip files and paths that no longer exist — with first/last interaction times.

SBECmd.exe -d "E:\case042\tout\C\Users\bob" --csv out          :: finds NTUSER.DAT + UsrClass.dat under the profile
SBECmd.exe -d "E:\case042\tout\C\Users" --csv out --dedupe     :: all users
SBECmd.exe -l --csv out                                        :: live (current user, admin for others)
SBECmd.exe -d Users\bob --csv out --nl                         :: don't replay transaction logs

ShellBags Explorer (ShellBagsExplorer.exe) is the GUI: File → Load offline hive (pick UsrClass.dat, then it asks for NTUSER.DAT), tree on the left mirrors the folder hierarchy the user saw. AbsolutePath, FirstInteracted, LastInteracted, MFTEntryNumber/SequenceNumber (pivot back into MFTECmd output). Look for \\server\share, D:\/E:\ (removable), This PC\... under GUIDs, and folder names like Tools, loot, exfil.

SrumECmd — SRUM (SRUDB.dat + SOFTWARE hive)

Per-application network bytes sent/received, energy and CPU usage in hourly buckets for ~30–60 days. The exfiltration detector.

SrumECmd.exe -f "E:\case042\tout\C\Windows\System32\sru\SRUDB.dat" -r "E:\case042\tout\C\Windows\System32\config\SOFTWARE" --csv out
:: If the ESE database is dirty (collected live) repair it first:
esentutl.exe /r sru /i /d      (run in a copy of the sru folder)
esentutl.exe /p SRUDB.dat

CSVs: *_NetworkUsages (app, user SID, interface, BytesSent/BytesReceived, hour), *_NetworkConnections, *_AppResourceUseInfo, *_EnergyUsage, *_PushNotifications, *_vfuprov. Sort BytesSent descending; a 4 GB upload by rclone.exe or powershell.exe at 03:00 is the story.

WxTCmd — Windows Timeline (ActivitiesCache.db)

App focus and file-open activity per user (Win10 1803 – 22H2), with start/end times and duration.

WxTCmd.exe -f "E:\case042\tout\C\Users\bob\AppData\Local\ConnectedDevicesPlatform\L.bob\ActivitiesCache.db" --csv out

Two CSVs: *_Activity (app, StartTime, EndTime, Duration, payload with the document path) and *_Activity_PackageId. Disabled by default on Win11.

RBCmd — Recycle Bin ($Recycle.Bin\<SID>\$I*)

Original path, size and deletion time of every file in the bin (the $I metadata file; $R is the content).

RBCmd.exe -d "E:\case042\tout\C\$Recycle.Bin" --csv out -q
RBCmd.exe -f "$IABC123.txt"

SQLECmd — any SQLite (browsers, Teams, Slack, Windows Search, Signal …)

Runs a library of community “maps” (queries) against every SQLite DB it recognises, producing a tidy CSV per map instead of you hand-writing SQL.

SQLECmd.exe --sync                                              :: update maps
SQLECmd.exe -d "E:\case042\tout\C\Users" --csv out              :: finds and parses everything it has a map for
SQLECmd.exe -f "History" --csv out                              :: Chrome/Edge history
SQLECmd.exe -f places.sqlite --csv out --dedupe                 :: Firefox

bstrings — better strings

strings with regex, Unicode/UTF-16 aware, and built-in patterns for IPs, emails, URLs, GUIDs, MACs, credit cards, bitcoin addresses.

bstrings.exe -f pagefile.sys --lr ipv4                          :: built-in regex: ipv4, ipv6, email, url, guid, mac, ssn, cc, b64, win_path, unc, reg_path, sid, aeon, bitcoin, xml
bstrings.exe -f mem.raw --ls "Invoke-Mimikatz" -q               :: literal search
bstrings.exe -f mem.raw --lr "https?://[^\s\"']+" -m 8 -x 200   :: custom regex, min/max length
bstrings.exe -f hiberfil.sys --fs iocs.txt -o hits.txt          :: file of strings to search for
bstrings.exe -d E:\case042\tout\C\Users\bob\Downloads --lr email --ro   :: recurse a dir, --ro = show offsets
bstrings.exe -p                                                 :: list built-in patterns

The Linux/macOS counterpart is in strings & file triage.

The rest of the toolbox

Timeline Explorer — reviewing the CSVs

Open any EZ CSV (or drag several in — each becomes a tab). It recognises the column names and sets types (timestamps sort as time, not text).

[!tip] The merged-timeline shortcut PECmd’s *_Timeline.csv, EvtxECmd output, MFTECmd’s CSV and LECmd all share a first timestamp column. Open all of them in Timeline Explorer, filter each to the same 15-minute window, and you have a multi-artefact timeline without plaso. When you need the full super-timeline (thousands of files, every artefact) use MFTECmd --body + mactime, or the KAPE Plaso_Timeline module.

Worked triage: from live box to answers in ~30 minutes

:: 1. Collect (USB E:, 3–8 min for a workstation)
kape.exe --tsource C: --tdest E:\c42\tout --target !SANS_Triage --vhdx WS042 --zv false --gui
:: 2. Mount the VHDX read-only (Disk Management → Attach VHD → Read-only, or Arsenal Image Mounter), say it lands on F:
:: 3. Parse everything
kape.exe --msource F: --mdest E:\c42\mout --module !EZParser --gui
:: 4. Detection pass over the event logs while you wait
hayabusa.exe csv-timeline -d F:\C\Windows\System32\winevt\Logs -o E:\c42\hayabusa.csv --no-wizard -p verbose

Then in Timeline Explorer, in this order:

1. EventLogs\*.csv — filter EventId in 4624,4625,4648,4672,4688,7045,4698,1102; note first suspicious logon time T0 and the account.
2. ProgramExecution\*Amcache*UnassociatedFileEntries.csv — sort FileKeyLastWriteTimestamp ≥ T0; anything under Users\, Temp\, ProgramData\, Public\ gets its SHA-1 checked.
3. ProgramExecution\*PECmd_Output_Timeline.csv — same window; confirm execution and get the exact run times.
4. FileSystem\*MFTECmd*.csv — filter Created0x10 in the window, ParentPath for the dirs above; check SI<FN for timestomps, ZoneIdContents for download origin.
5. FileFolderAccess\ (LECmd/JLECmd/SBECmd) — what did the account open/browse; ShellBags for USB/shares.
6. Registry\ (RECmd batch) — Run keys, services, UserAssist, BAM, MountedDevices, TypedPaths.
7. SRUMDatabase\*NetworkUsages.csv — bytes out per process in the window.
8. Tag rows as you go, File → Export the tagged set per tab → the timeline in your report.

Related

• Digital Forensics reference — the “where is it and what does it prove” table this sheet parses
• RECmd registry forensics — the registry half of the suite
• Acquisition — image first when you can
• GUI tools — Registry Explorer, Timeline Explorer, Autopsy, FTK Imager walkthroughs
• Volatility 3 — the memory image KAPE cannot give you