decrypting…# 🎉 Welcome to EZ Tools! 🎉 #tool #BLUE #TTLIST  ## 🔍 Explore the Power of Eric Zimmerman's Forensic Tools Welcome to **EZ Tools**! Dive into a collection of powerful, open-source forensic utilities developed by Eric Zimmerman. These tools are designed to assist digital forensic investigators in analyzing various artifacts with precision and efficiency. --- ## 🛠️ Comprehensive Tool List Below is a curated list of Eric Zimmerman's tools, each accompanied by a brief description: | 🛠 Tool Name | 🔎 Description | |--------------------------|----------------------------------------------------------------| | **AmcacheParser** | Parses the Amcache.hve file to extract detailed information about executed applications. | | **AppCompatCacheParser** | Analyzes the Application Compatibility Cache to identify recently executed applications. | | **bstrings** | Extracts and analyzes strings from binary files, enhancing malware analysis capabilities. | | **EvtxECmd** | Efficiently processes Windows Event Log files (.evtx) to extract valuable event data. | | **IISGeoLocate** | Geolocates IP addresses found in IIS logs, providing insights into the origin of web requests. | | **JLECmd** | Parses Jump List files to reveal information about recently accessed applications and files. | | **LECmd** | Analyzes Windows Shortcut files (.lnk) to extract metadata and linked file information. | | **MFTECmd** | Parses the Master File Table (MFT) from NTFS file systems, offering a comprehensive view of file system metadata. | | **PECmd** | Processes Prefetch files to uncover details about application execution, including run count and last execution time. | | **RecentFileCacheParser** | Extracts information from the RecentFileCache.bcf file, shedding light on recently accessed files. | | **RECmd** | A powerful Windows Registry parser and query tool, enabling advanced analysis of registry hives. | | **Registry Explorer** | A feature-rich GUI-based registry viewer and analysis tool, facilitating in-depth examination of Windows registry hives. | | **RLA** | Analyzes Recycle Bin artifacts to determine deleted files and their original locations. | | **SDB Explorer** | Explores and parses Windows Application Compatibility Database files (.sdb) to identify application-related information. | | **SBECmd** | Parses ShellBag artifacts to reveal folder access history, providing insights into user activity. | | **ShellBags Explorer** | A GUI tool for analyzing ShellBag artifacts, offering a visual representation of folder access history. | | **SQLECmd** | Processes SQLite database files, enabling the extraction and analysis of stored data. | For a comprehensive manual on these tools, visit the [EZ Tools Manuals](https://leanpub.com/eztoolsmanuals). --- ## 📺 Learn More For an in-depth guide on using these command-line tools, check out the following video: [](https://www.youtube.com/watch?v=GhCZfCzn2l0) ---