EZ Tools Guide: MFTECmd, EvtxECmd and RECmd

Windows investigations live or die on how quickly and accurately responders can turn raw artefacts such as the $MFT, event logs, registry hives and prefetch files into rows they can sort, filter and explain. EZ Tools is a free suite of command-line parsers and graphical viewers for Windows forensic artefacts, written by Eric Zimmerman with open source development funded by SANS. Most Windows DFIR workflows, including KAPE module processing, call these tools. This guide explains what each tool parses, how to use them defensibly for common investigation questions, how to deploy and validate them, and what their output tells you about detection gaps. It goes deeper on parsing than the KAPE and Triage Collection Guide, which covers collection, and is written for DFIR analysts and incident responders. Tool lists, options and runtime versions were checked against the project site and GitHub repositories on 27 October 2026.

Key takeaways

One parser per artefact. MFTECmd, EvtxECmd, RECmd, PECmd, AmcacheParser, AppCompatCacheParser, LECmd, JLECmd, SBECmd, RBCmd and SrumECmd each turn one artefact type into CSV or JSON; Timeline Explorer is the viewer for that output.
Two runtimes. Builds target .NET Framework 4.7.2 (Windows only) and .NET 10, which is the default and recommended build and lets several CLI tools run on Linux and macOS.
Maps and batch files are the intelligence. EvtxECmd maps normalise event payloads into fields such as UserName, RemoteHost and ExecutableInfo; RECmd batch files (DFIRBatch) define which registry keys matter. Keep both current.
Dirty hives need their logs. RECmd refuses a dirty hive without its .LOG1 and .LOG2 transaction logs unless you force it; replay logs with RLA so you do not miss recent changes.
Verify signatures, then trust. The binaries are digitally signed; verify the signature, then treat antivirus detections as false positives rather than disabling protection wholesale.

What the tool does

The suite is maintained on GitHub, with most repositories under the MIT licence, and distributed from the project site. The PowerShell script Get-ZimmermanTools downloads and updates the tools: -Dest sets the folder and -NetVersion selects 4 (.NET 4.7.2), 10 (.NET 10, the default) or 0 (all). Some tools, mainly the GUIs and newer parsers such as AmcacheParser, SQLECmd, VSCMount and WxTCmd, are offered only for .NET 10.

Tool	Parses	Typical investigative use
MFTECmd	`$MFT`, `$UsnJrnl:$J`, `$LogFile`, `$Boot`, `$Secure:$SDS`, `$I30`	File creation, rename and delete history; timestomping; deleted directory entries
EvtxECmd	EVTX event logs, with maps	Logons, services, scheduled tasks, PowerShell, RDP, log clearing
RECmd and Registry Explorer	Registry hives, multi-hive search, plugins, deleted key recovery	Persistence, user activity, USB devices, configuration changes
RLA	Registry transaction logs	Replay logs into dirty hives before parsing
PECmd	Prefetch (.pf), including compressed Windows 10 and 11 files	Executable name, path, run count, last run times, files and volumes referenced
AmcacheParser	Amcache.hve, including Windows 11 26H2 databases	Programs and files present or executed, with SHA-1 hashes
AppCompatCacheParser	AppCompatCache (ShimCache)	Evidence of executables present on the system
LECmd and JLECmd	LNK files and jump lists	Files and folders opened, including from removable or network drives
SBECmd and ShellBags Explorer	ShellBags	Folders a user browsed, including deleted or remote ones
RBCmd	Recycle Bin (`INFO2` and `$I` files)	Deleted file names, paths, sizes and deletion times
SrumECmd	SRUDB.dat, optionally with the SOFTWARE hive	Per-application network usage and resource history
SumECmd	User Access Logging (SUM directory) on Windows Server	Which accounts and IPs accessed server roles
WxTCmd	Windows 10 and 11 Timeline database	User application and file activity
bstrings	Any file, with built-in regex patterns	Find URLs, IPs, paths and credential-like strings
Timeline Explorer	CSV and Excel output	Filter, group and sort parser output

Key options for the core parsers

MFTECmd: -f takes the file (type is detected from content); --csv or --json set the output directory; --body with --bdl writes a bodyfile for mactime-style timelines; --de dumps full details of one MFT entry, and with --fls lists a directory's contents; --vss processes all shadow copies and --dedupe removes duplicates by SHA-1. $LogFile output decodes $STANDARD_INFORMATION timestamp changes with their previous values, and --at includes all $FILE_NAME (0x30) timestamps rather than only those that differ from $STANDARD_INFORMATION (0x10).
EvtxECmd: -f for one log or -d for a directory; --csv, --json or --xml outputs; --maps points to map files; --inc and --exc filter event IDs (for example 4624,4625,5500-5600); --sd and --ed set a UTC date window; --vss and --dedupe as above; --met shows metrics. The library flags records hidden inside another record's slack (as produced by the DanderSpritz eventlogedit tool) with HiddenRecord.
RECmd: -f or -d; --bn loads a batch file such as DFIRBatch; --sk, --sv, --sd and --ss search key names, value names, value data and value slack (with --regex); --recover (on by default) recovers deleted keys and values; --nl processes dirty hives without logs, which you should avoid.
PECmd: -f or -d; -k highlights keywords (default temp and tmp); --csv also writes a run-time timeline; --mp shows higher-precision timestamps.

Defender use cases

Investigation question	Tools and artefacts	ATT&CK context
What ran on patient zero, and when?	PECmd, AmcacheParser, AppCompatCacheParser, EvtxECmd for 4688 or Sysmon 1	T1204.002 Malicious File
How did the attacker persist?	EvtxECmd (System 7045, Task Scheduler), RECmd with DFIRBatch (Run keys, services)	T1543.003 Windows Service, T1053.005 Scheduled Task, T1547.001 Registry Run Keys
Which accounts logged on, from where?	EvtxECmd maps for 4624, 4625, 4648 and RDP logs; SumECmd on servers	T1021.001 Remote Desktop Protocol, T1078 Valid Accounts
Were files timestomped or wiped?	MFTECmd on `$MFT`, `$J` and `$LogFile`	T1070.006 Timestomp, T1070.004 File Deletion
Was the log cleared or doctored?	EvtxECmd for 1102 and 104, hidden records in slack	T1685.005 Clear Windows Event Logs
What data was staged or taken?	LECmd, JLECmd, SBECmd, RBCmd, SrumECmd network usage	T1074.001 Local Data Staging

For what each artefact means and its pitfalls, see the Windows Forensic Artefacts Guide. For timestamp manipulation in depth, see the Anti-Forensics Detection Guide.

Typical workflow

Collect: acquire a triage package or image with KAPE, Velociraptor or a full imager, preserving hashes.
Prepare: replay registry transaction logs with RLA (--out saves clean hives) and mount shadow copies if needed (VSCMount).
Parse: run each parser to CSV into a per-host output folder, usually through KAPE modules so the command lines are consistent.
Review: open CSVs in Timeline Explorer, filter to the incident window and pivot on users, paths and hashes.
Merge: combine with Plaso or a SIEM for a cross-artefact timeline. See the Plaso Guide and the Forensic Timeline Analysis Guide.

Deployment and safe use

Pin a toolset per case: run Get-ZimmermanTools into a dated folder, record versions (MFTECmd reported 2026.10.6 on the check date), and do not update mid-case unless a parser bug forces it; note any update.
Verify signatures: check the digital signature on each binary after download and before use on a forensic workstation.
Work on copies: parse collected artefacts or mounted read-only images, never a live production system unless you are deliberately doing live response and recording it.
Keep maps and batch files current: update EvtxECmd maps and the DFIRBatch file with the tools, and keep local custom maps in version control with review.
Handle dirty hives properly: collect the .LOG1 and .LOG2 files alongside hives; use --nl only knowingly and record it.
Protect output: CSVs contain usernames, paths, command lines and sometimes secrets; store them with the case evidence. See the Evidence Handling and Chain of Custody Guide.
Validate: parse a reference image of your standard build after each toolset update and compare row counts and key fields with the previous version.
Cross-platform runs: the .NET 10 builds allow parsing on Linux analysis hosts, but Windows-only features such as --vss need Windows.

Detection and hardening value

Parser output shows what attackers did that your telemetry did not alert on. Feed each case back into detection and logging.

Finding	Improvement	Framework reference
Execution visible only in prefetch or Amcache	Enable process creation with command line (4688) or Sysmon; see the Sysmon Guide	NIST SP 800-53 AU-12
Persistence key set with no alert	Registry monitoring on autostart locations; detections in Sigma format; see the Sigma Rules Guide	NIST SP 800-53 SI-4
Security log cleared or records hidden	Forward events off-host; see the Windows Event Forwarding Guide	NIST SP 800-53 AU-9
Data staged then deleted	File activity monitoring on staging paths, DLP	NIST CSF 2.0 DE.CM-09
Root cause established from artefacts	Lessons learned and control changes	NIST CSF 2.0 RS.AN-03

Where identity fits

Windows artefacts are a record of which identities did what. EvtxECmd output for logon events, SumECmd for server access and RECmd for profile hives show which human, local administrator and service accounts were used on each host. List every account seen in the incident window, compare against expected use, and check bstrings or RECmd hits for stored credentials. See the Service Account Security Guide.

Measuring the capability

Time to parsed artefacts: minutes from triage package receipt to CSVs in Timeline Explorer (target under 30 minutes per host).
Toolset currency: age of the pinned toolset and map set, reviewed monthly.
Validation pass rate: reference image comparisons passed after each update.
Telemetry gaps: attacker actions found only in parsed artefacts per case.

Common failure patterns

Parsing dirty hives without logs: the most recent persistence changes are missing from output.
Stale maps: new event providers appear as unparsed payloads and analysts overlook them.
Treating ShimCache or Amcache as proof of execution: these record presence or execution depending on version and context; corroborate with prefetch or event logs.
Mixed time zones: parser output is UTC; analysts annotate in local time and misorder events.
Disabling antivirus globally: to stop detections on signed tools, analysts turn off protection on a workstation that then handles malware samples.

Alternatives

Option	Choose it when	Trade-off
EZ Tools	Fast, precise Windows artefact parsing to CSV	Windows artefacts only; you merge timelines yourself
Plaso	One super timeline across platforms	Slower; less per-artefact detail
Hayabusa or Chainsaw	Sigma-based triage of event logs	Event logs only; see the Hayabusa and Chainsaw Guide
Velociraptor artefacts	Parsing at scale on live endpoints	Requires agent deployment; see the Velociraptor Guide
Autopsy	Full disk case work with a GUI	Less granular Windows artefact output; see the Autopsy and The Sleuth Kit Guide

Small teams typically run KAPE with EZ Tools modules on a single workstation; larger teams automate parsing in a processing pipeline and push CSV output into a SIEM or Timesketch.

Practitioner checklist

Download the suite with Get-ZimmermanTools into a dated, version-recorded folder and verify signatures.
Standardise on the .NET 10 builds unless a Windows-only feature requires .NET 4.7.2.
Collect registry transaction logs with hives and replay them with RLA before parsing.
Keep EvtxECmd maps and RECmd batch files updated and custom versions under version control.
Parse artefacts to CSV per host and review in Timeline Explorer within a defined incident window.
Corroborate execution claims across at least two artefacts.
Validate each toolset update against a reference image.
Record every account seen and every detection gap found, and raise fixes.

EZ Tools Guide: Parsing Windows Artefacts with MFTECmd, EvtxECmd and RECmd