Meta tags:
description=Eric Zimmerman s Tools;
author=Eric Zimmerman;

Headings (most frequently used words):

tools, other, home, tl, dr, contribute, support, opportunities, forensic, files, requirements, and, troubleshooting,

Text of the page (most frequently used words):
2026 (46), vert (31), and (23), files (17), the (13), tools (13), net (12), parser (10), for (9), you (8), with (7), #support (7), get (7), all (7), locked (7), use (6), other (6), explorer (6), handles (6), home (6), are (5), gui (5), logs (5), eric (4), zimmerman (4), software (4), from (4), when (4), least (4), windows (4), requirements (4), troubleshooting (4), log (4), data (4), process (4), registry (4), viewer (4), ericzimmerman (4), dpi (3), high (3), any (3), doubt (3), will (3), running (3), microsoft (3), not (3), things (3), found (3), purpose (3), version (3), name (3), csv (3), hive (3), shellbags (3), how (3), more (3), tool (3), forensic (3), github (3), contribute (3), opportunities (3), sans (2), scaling (2), directly (2), then (2), click (2), under (2), change (2), once (2), coming (2), download (2), here (2), requires (2), newer (2), errors (2), these (2), without (2), install (2), sure (2), programs (2), run (2), them (2), directory (2), current (2), optionally (2), artifact (2), many (2), features (2), script (2), update (2), zimmermantools (2), timeline (2), database (2), mount (2), find (2), your (2), maps (2), command (2), line (2), transaction (2), longer (2), searching (2), multi (2), plugins (2), mft (2), jump (2), list (2), built (2), versions (2), control (2), recommended (2), this (2), page (2), changelog (2), benchmarks (2), build (2), self (2), contained (2), exes (2), documentation (2), made, zensical, open, source, development, funding, provided, following, contributors, dfir, institute, issues, make, shortcut, against, exe, edit, properties, compatibility, settings, check, override, behavior, bottom, choose, system, out, dialog, tip, digitally, signed, verify, signature, anti, virus, hits, false, positives, runtime, plan, desktop, zip, winrar, block, dlls, extract, unless, administrator, anything, program, warning, changes, ways, forensics, installation, manager, xwfim, simple, app, that, shows, time, local, utc, public, address, great, testing, timeapp, kroll, extractor, flexible, speed, collection, well, processing, kape, geolocate, addresses, iis, extracts, unique, ips, records, bad, iisgeolocate, powershell, auto, discover, everything, above, wxtcmd, vscs, drive, letter, given, point, vscmount, view, excel, filter, group, sort, etc, ease, user, access, system32, logfiles, sum, sumecmd, srudb, dat, network, energy, info, srumecmd, sqlite, according, needs, sqlecmd, browsing, edition, exporting, shellbag, sbecmd, shim, sdb, replay, hives, they, dirty, useful, know, handle, rla, powerful, recmd, recentfilecache, recentfilecacheparser, recycle, bin, info2, rbcmd, prefetch, pecmd, graphical, mftexplorer, boot, sds, i30, logfile, soon, mftecmd, parse, lnk, lecmd, based, jumplist, jlecmd, hash, hasher, standalone, zero, dependency, doc, docx, xls, xlsx, txt, rtf, otd, htm, html, mht, pdf, non, supported, shown, hex, editor, interpreter, ezviewer, event, evtx, standardized, xml, json, output, custom, file, evtxecmd, strings, regex, patterns, bstrings, appcompatcache, aka, shimcache, appcompatcacheparser, amcache, hve, lots, extra, amcacheparser, paypal, sponsors, continue, both, cli, updated, only, legacy, net4, available, note, keep, set, which, flavor, default, netversion, where, ends, else, end, same, dest, section, read, search, skip, content,

Text of the page (random words):
home eric zimmerman s tools skip to content eric zimmerman s tools home search ericzimmerman ericzimmerman github io home documentation how to build self contained exes benchmarks changelog eric zimmerman s tools ericzimmerman ericzimmerman github io home home on this page tl dr contribute support opportunities forensic tools other tools other files requirements and troubleshooting documentation how to build self contained exes benchmarks changelog on this page tl dr contribute support opportunities forensic tools other tools other files requirements and troubleshooting home tl dr read the requirements and troubleshooting section use get zimmermantools to download all programs at once and keep your tool set current use dest to control where the tools ends up else things end up in same directory as the script recommended use netversion to control which flavor of tool you get 4 for net 4 7 2 or 9 for net 9 recommended or 0 for all versions default is 9 note all gui tools are updated to use net 9 only legacy net4 versions are no longer available all cli tools continue to be built for both net 4 7 2 and net 9 contribute support opportunities github sponsors paypal forensic tools name version net 4 vert 9 purpose amcacheparser 2026 5 0 vert 2026 5 0 amcache hve parser with lots of extra features handles locked files appcompatcacheparser 2026 5 0 vert 2026 5 0 appcompatcache aka shimcache parser handles locked files bstrings 2026 5 0 vert 2026 5 0 find them strings yo built in regex patterns handles locked files evtxecmd 2026 5 0 vert 2026 5 0 event log evtx parser with standardized csv xml and json output custom maps locked file support and more ezviewer vert 2026 5 0 standalone zero dependency viewer for doc docx xls xlsx txt log rtf otd htm html mht csv and pdf any non supported files are shown in a hex editor with data interpreter hasher 2026 5 0 vert hash all the things jlecmd 2026 5 0 vert 2026 5 0 jump list parser jumplist explorer vert 2026 5 0 gui based jump list viewer lecmd 2026 5 0 vert 2026 5 0 parse lnk files mftecmd 2026 5 0 vert 2026 5 0 mft boot j sds i30 and logfile coming soon parser handles locked files mftexplorer vert 2026 5 0 graphical mft viewer pecmd 2026 5 0 vert 2026 5 0 prefetch parser rbcmd 2026 5 0 vert 2026 5 0 recycle bin artifact info2 i parser recentfilecacheparser 2026 5 0 vert 2026 5 0 recentfilecache parser recmd 2026 5 0 vert 2026 5 0 powerful command line registry tool searching multi hive support plugins and more registry explorer vert 2026 5 0 registry viewer with searching multi hive support plugins and more handles locked files rla 2026 5 0 vert 2026 5 0 replay transaction logs and update registry hives so they are no longer dirty useful when tools do not know how to handle transaction logs sdb explorer vert 2026 5 0 shim database gui sbecmd 2026 5 0 vert 2026 5 0 shellbags explorer command line edition for exporting shellbag data shellbags explorer vert 2026 5 0 gui for browsing shellbags data handles locked files sqlecmd vert 2026 5 0 find and process sqlite files according to your needs with maps srumecmd 2026 5 0 vert 2026 5 0 process srudb dat and optionally software hive for network process and energy info sumecmd 2026 5 0 vert 2026 5 0 process microsoft user access logs found under c windows system32 logfiles sum timeline explorer vert 2026 5 0 view csv and excel files filter group sort etc with ease vscmount vert 2026 5 0 mount all vscs on a drive letter to a given mount point wxtcmd vert 2026 5 0 windows 10 timeline database parser other tools name version net 4 vert 9 purpose get zimmermantools na powershell script to auto discover and update everything above iisgeolocate 2026 5 0 vert 2026 5 0 geolocate ip addresses found in iis logs extracts unique ips records bad data from logs kape na kroll artifact parser extractor flexible high speed collection of files as well as processing of files many many features timeapp 2026 5 0 vert a simple app that shows current time local and utc and optionally public ip address great for testing xwfim 2026 5 0 vert x ways forensics installation manager other files name version purpose change log na to log changes requirements and troubleshooting warning do not run anything found here from c program files directory unless you run them as administrator do not use windows to extract things use 7 zip or winrar as windows will block the dlls net 4 software requires at least microsoft net 4 7 2 or newer you will get errors running these without at least 4 7 2 when in doubt install it net 9 software requires at least microsoft net 9 or newer you will get errors running these without at least net 9 when in doubt install it be sure sure you get the desktop runtime if you plan on running any of the gui programs all software is digitally signed once you verify the signature as coming from me any anti virus hits are false positives when in doubt download the files directly from here tip if you get dpi scaling issues make a shortcut or directly against the exe edit the properties then click compatibility under change high dpi settings check override high dpi scaling behavior at bottom and choose system then click ok out of the dialog open source development funding and support provided by the following contributors sans institute and sans dfir 2026 eric zimmerman made with zensical