Is AmcacheParser free?
Yes. MIT-licensed. Free for any use. Personal, commercial, internal, consulting engagements, government work, training. No tiers. No nag screens. No telemetry. No account. No usage limits.
The tool ships from Eric Zimmerman's GitHub repos and is mirrored at ericzimmerman.github.io. The license file is in the repository.
Who maintains it#
Eric Zimmerman. Ex-FBI Special Agent, now Senior Director at Kroll. He has been publishing free DFIR tooling for over a decade. AmcacheParser is one of about a dozen tools he maintains. The full set (commonly called the Zimmerman tools or Get-ZimmermanTools) is the de facto standard Windows DFIR toolset:
| Tool | Parses |
|---|---|
| AmcacheParser | Amcache.hve |
| MFTECmd | $MFT, $LogFile, $J, $Boot, $SDS |
| RECmd | Any registry hive, batch processor |
| RBCmd | Recycle Bin ($I* files) |
| PECmd | Windows Prefetch |
| EvtxECmd | Windows Event Logs |
| JLECmd | Jump Lists |
| LECmd | Windows LNK files |
| SBECmd | Shellbags |
| AppCompatCacheParser | Shimcache |
| SrumECmd | SRUM (SRUDB.dat) |
All MIT, all free, all produce structured CSV that loads cleanly into Timeline Explorer.
Paid alternatives#
A few commercial DFIR suites also parse Amcache as part of bigger packages:
- Magnet AXIOM
- X-Ways Forensics
- EnCase
- FTK
They cost real money and bundle dozens of other parsers, case management, court-ready output, and certifications. For Amcache specifically, the Zimmerman tool produces output most paid platforms can ingest. If your team is already standardised on a commercial suite, use it. Otherwise the free tool is genuinely the canonical option.
What's the catch#
Functionally, none. Two practical limits:
- No vendor support. Bugs go to GitHub issues. Eric and the community are responsive but there is no SLA.
- Windows-first. The tool runs cross-platform via .NET, but the docs and ecosystem assume Windows. Linux and macOS users follow the Linux/macOS guide.
What about this site#
The browser parser at amcacheparser.com is also free and runs entirely client-side. It is an independent re-implementation of the read path in Rust + WebAssembly, designed for triage and education. Not affiliated with Eric or Kroll. For a full investigation on a Windows workstation, use Eric's AmcacheParser.exe. For triage or no-install scenarios, use the browser version. Both are free.
Related#
Related posts
- Who created AmcacheParser?
Eric Zimmerman. Ex-FBI, now Senior Director at Kroll. Maintains the de facto standard Windows DFIR tool suite.
- Why is my Amcache.hve empty?
Three causes in order of frequency: appraiser disabled, host freshly imaged, or you're on a Server where the cadence is naturally slow. Tampering is a distant fourth.
- Where is the Amcache registry key?
Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.
- What does Amcache.hve contain?
Inventory records for every PE, driver, application, and connected device the Compatibility Appraiser has seen. SHA-1, full path, publisher, and timestamps per entry.