Posts tagged "amcacheparser"

• Who created AmcacheParser?

  Eric Zimmerman. Ex-FBI, now Senior Director at Kroll. Maintains the de facto standard Windows DFIR tool suite.

  2026-05-24

• Is AmcacheParser free? Yes — MIT-licensed, commercial OK

  Yes. MIT-licensed, free for any use including commercial DFIR. The rest of Eric Zimmerman's tools too.

  2026-05-24

• AmcacheParser output columns explained: every CSV field decoded

  Field-by-field reference for AmcacheParser's CSV output. FileId, PathHash, ProgramId, LinkDate, BinFileVersion, IsPeFile, and every other column, with the pivots that matter.

  2026-05-24

• AmcacheParser download guide: official sources, mirrors, and verification

  Where to get AmcacheParser. Get-ZimmermanTools, direct download, KAPE, Velociraptor. Plus checksum verification and the air-gapped install pattern.

  2026-05-24

• AmcacheParser: the complete guide to Eric Zimmerman's tool

  How to download, run and read AmcacheParser, Eric Zimmerman's Amcache.hve parser: install, command-line options, CSV output and a browser alternative.

  2026-05-24

• AmcacheParser CLI cheatsheet: every flag, with worked examples

  Copy-paste reference for AmcacheParser.exe. Every flag explained. KAPE, Velociraptor, and PowerShell batch patterns you can use directly.

  2026-05-24

• Amcache parsers compared: AmcacheParser CLI, browser tool, Volatility, RegRipper

  Four mature parsers for Amcache.hve. Same hive, different workflows. The decision rule comes down to install footprint, batchability, and where each one wins.

  2026-05-24