# 🎉 Welcome to EZ Tools! 🎉
#tool  #BLUE  #TTLIST 

![EZ Tools Banner](https://ericzimmerman.github.io/logoSmall.jpg)

## 🔍 Explore the Power of Eric Zimmerman's Forensic Tools

Welcome to **EZ Tools**! Dive into a collection of powerful, open-source forensic utilities developed by Eric Zimmerman. These tools are designed to assist digital forensic investigators in analyzing various artifacts with precision and efficiency.

---

## 🛠️ Comprehensive Tool List

Below is a curated list of Eric Zimmerman's tools, each accompanied by a brief description:

| 🛠 Tool Name              | 🔎 Description |
|--------------------------|----------------------------------------------------------------|
| **AmcacheParser**        | Parses the Amcache.hve file to extract detailed information about executed applications. |
| **AppCompatCacheParser** | Analyzes the Application Compatibility Cache to identify recently executed applications. |
| **bstrings**             | Extracts and analyzes strings from binary files, enhancing malware analysis capabilities. |
| **EvtxECmd**             | Efficiently processes Windows Event Log files (.evtx) to extract valuable event data. |
| **IISGeoLocate**         | Geolocates IP addresses found in IIS logs, providing insights into the origin of web requests. |
| **JLECmd**               | Parses Jump List files to reveal information about recently accessed applications and files. |
| **LECmd**                | Analyzes Windows Shortcut files (.lnk) to extract metadata and linked file information. |
| **MFTECmd**              | Parses the Master File Table (MFT) from NTFS file systems, offering a comprehensive view of file system metadata. |
| **PECmd**                | Processes Prefetch files to uncover details about application execution, including run count and last execution time. |
| **RecentFileCacheParser** | Extracts information from the RecentFileCache.bcf file, shedding light on recently accessed files. |
| **RECmd**                | A powerful Windows Registry parser and query tool, enabling advanced analysis of registry hives. |
| **Registry Explorer**     | A feature-rich GUI-based registry viewer and analysis tool, facilitating in-depth examination of Windows registry hives. |
| **RLA**                  | Analyzes Recycle Bin artifacts to determine deleted files and their original locations. |
| **SDB Explorer**         | Explores and parses Windows Application Compatibility Database files (.sdb) to identify application-related information. |
| **SBECmd**               | Parses ShellBag artifacts to reveal folder access history, providing insights into user activity. |
| **ShellBags Explorer**   | A GUI tool for analyzing ShellBag artifacts, offering a visual representation of folder access history. |
| **SQLECmd**              | Processes SQLite database files, enabling the extraction and analysis of stored data. |

For a comprehensive manual on these tools, visit the [EZ Tools Manuals](https://leanpub.com/eztoolsmanuals).

---

## 📺 Learn More

For an in-depth guide on using these command-line tools, check out the following video:

[![A Guide to Eric Zimmerman's Command Line Tools](https://img.youtube.com/vi/GhCZfCzn2l0/0.jpg)](https://www.youtube.com/watch?v=GhCZfCzn2l0)

---