Home
⚡ TL;DR
- READ the Requirements and troubleshooting section!!
- Use Get-ZimmermanTools to download all programs at once and keep your tool set current
- Use -Dest to control where the tools ends up, else things end up in same directory as the script (recommended!)
- Use -NetVersion to control which flavor of tool you get:
4for .net 4.7.2 or10for .net 10 (recommended!), or0for all versions. Default is10
Note
- GUI tools are .net 10 only, except TimeApp, which is also built for .net 4.
- CLI tools are built for both .net 4.7.2 and .net 10, except AmcacheParser, SQLECmd, VSCMount and WxTCmd, which are .net 10 only.
💖 Contribute/support opportunities
🔍 Forensic tools
⌨️ command line tool 🖥️ GUI 📜 script 🎒 KAPE
| Name | Version (.net 4 | 10) | Purpose |
|---|---|---|
| ⌨️ AmcacheParser | - | 2026.10.0 | Amcache.hve parser with lots of extra features, including the Windows 11 26H2 Amcache databases. Handles locked files |
| ⌨️ AppCompatCacheParser | 2026.10.0 | 2026.10.0 | AppCompatCache aka ShimCache parser. Handles locked files |
| ⌨️ bstrings | 2026.10.0 | 2026.10.0 | Find them strings yo. Built in regex patterns. Handles locked files |
| ⌨️ EvtxECmd | 2026.10.1 | 2026.10.1 | Event log (evtx) parser with standardized CSV, XML, and json output! Custom maps, locked file support, and more! |
| 🖥️ EZViewer | - | 2026.10.0 | Standalone, zero dependency viewer for .doc, .docx, .xls, .xlsx, .txt, .log, .rtf, .otd, .htm, .html, .mht, .csv, and .pdf. Any non-supported files are shown in a hex editor (with data interpreter!) |
| 🖥️ Hasher | - | 2026.10.0 | Hash all the things |
| ⌨️ JLECmd | 2026.10.3 | 2026.10.3 | Jump List parser |
| 🖥️ JumpList Explorer | - | 2026.10.1 | GUI based Jump List viewer |
| ⌨️ LECmd | 2026.10.2 | 2026.10.2 | Parse lnk files |
| ⌨️ MFTECmd | 2026.10.2 | 2026.10.2 | $MFT, $Boot, $J, $SDS, $I30, and $LogFile parser. Handles locked files |
| 🖥️ MFTExplorer | - | 2026.10.0 | Graphical $MFT viewer |
| ⌨️ PECmd | 2026.10.2 | 2026.10.2 | Prefetch parser |
| ⌨️ RBCmd | 2026.10.0 | 2026.10.0 | Recycle Bin artifact (INFO2/$I) parser |
| ⌨️ RecentFileCacheParser | 2026.10.1 | 2026.10.1 | RecentFileCache parser |
| ⌨️ RECmd | 2026.10.1 | 2026.10.1 | Powerful command line Registry tool searching, multi-hive support, plugins, and more |
| 🖥️ Registry Explorer | - | 2026.10.1 | Registry viewer with searching, multi-hive support, plugins, and more. Handles locked files |
| ⌨️ RLA | 2026.10.0 | 2026.10.0 | Replay transaction logs and update Registry hives so they are no longer dirty. Useful when tools do not know how to handle transaction logs |
| ⌨️ SBECmd | 2026.10.1 | 2026.10.1 | ShellBags Explorer, command line edition, for exporting shellbag data |
| 🖥️ SDB Explorer | - | 2026.10.0 | Shim database GUI |
| 🖥️ ShellBags Explorer | - | 2026.10.1 | GUI for browsing shellbags data. Handles locked files |
| ⌨️ SQLECmd | - | 2026.10.1 | Find and process SQLite files according to your needs with maps! |
| ⌨️ SrumECmd | 2026.10.0 | 2026.10.0 | Process SRUDB.dat and (optionally) SOFTWARE hive for network, process, and energy info! |
| ⌨️ SumECmd | 2026.10.0 | 2026.10.0 | Process Microsoft User Access Logs found under 'C:\Windows\System32\LogFiles\SUM' |
| 🖥️ Timeline Explorer | - | 2026.10.0 | View CSV and Excel files, filter, group, sort, etc. with ease |
| ⌨️ VSCMount | - | 2026.10.0 | Mount all VSCs on a drive letter to a given mount point |
| ⌨️ WxTCmd | - | 2026.10.0 | Windows 10/11 Timeline database parser |
🧰 Other tools
| Name | Version (.net 4 | 10) | Purpose |
|---|---|---|
| 📜 Get-ZimmermanTools | NA | PowerShell script to auto discover and update everything above. |
| ⌨️ iisGeoLocate | 2026.10.0 | 2026.10.0 | Geolocate IP addresses found in IIS logs, extracts unique IPs, records bad data from logs |
| 🎒 KAPE | NA | Kroll Artifact Parser/Extractor: Flexible, high speed collection of files as well as processing of files. Many many features |
| 🖥️ TimeApp | 2026.10.0 | 2026.10.0 | Shows the current time (local and UTC) to the microsecond, a stopwatch, a countdown, a timestamp converter (Unix, FILETIME, WebKit, Cocoa, OLE) and optionally, public IP addresses. Great for testing |
| 🖥️ XWFIM | - | 2026.10.0 | X-Ways Forensics installation manager |
📄 Other files
| Name | Version | Purpose |
|---|---|---|
| 📄 Change log | ChangeLog | To log changes |
⚠️ Requirements and troubleshooting
Warning
- DO NOT RUN ANYTHING FOUND HERE FROM 'C:\PROGRAM FILES' DIRECTORY (unless you run them as administrator)!
- DO NOT USE WINDOWS TO EXTRACT THINGS. Use 7-Zip or WinRAR as Windows will block the DLLs!
- .net 4 software requires at least Microsoft .net 4.7.2 or newer (TimeApp: .net 4.8)! You will get errors running these without it. When in doubt, install it!
- .net 10 software requires at least Microsoft .net 10 or newer! You will get errors running these without at least .net 10. When in doubt, install it! Be sure sure you get the Desktop runtime if you plan on running any of the GUI programs
- All software is digitally signed. Once you verify the signature as coming from me, any anti-virus hits are false positives. When in doubt, download the files directly from here!
Tip
The GUI programs scale themselves for each monitor (Per-Monitor V2 DPI awareness): they should look sharp and be the right size on any display, also when moved between monitors with different scaling. If you set Override high DPI scaling behavior on a shortcut or exe for an older version (Properties, Compatibility, Change high DPI settings), clear it: it now makes them blurry
Open Source Development funding and support provided by the following contributors: SANS Institute and SANS DFIR.