Posts tagged "amcacheparser"

• Who created AmcacheParser?

  Eric Zimmerman. Ex-FBI, now Senior Director at Kroll. Maintains the de facto standard Windows DFIR tool suite.

  2026-05-24

• Is AmcacheParser free?

  Yes. MIT-licensed, free for any use including commercial DFIR. The rest of Eric Zimmerman's tools too.

  2026-05-24

• AmcacheParser output columns explained: every CSV field decoded

  Field-by-field reference for AmcacheParser's CSV output. FileId, PathHash, ProgramId, LinkDate, BinFileVersion, IsPeFile, and every other column, with the pivots that matter.

  2026-05-24

• AmcacheParser download guide: official sources, mirrors, and verification

  Where to get AmcacheParser. Get-ZimmermanTools, direct download, KAPE, Velociraptor. Plus checksum verification and the air-gapped install pattern.

  2026-05-24

• AmcacheParser: the complete guide to Eric Zimmerman's tool

  The reference for AmcacheParser. What it does, how to install and run it, how to read the CSVs, and when the browser parser is the better tool for the moment.

  2026-05-24

• AmcacheParser CLI cheatsheet: every flag, with worked examples

  Copy-paste reference for AmcacheParser.exe. Every flag explained. KAPE, Velociraptor, and PowerShell batch patterns you can use directly.

  2026-05-24

• Amcache parsers compared: AmcacheParser CLI, browser tool, Volatility, RegRipper

  Four mature parsers for Amcache.hve. Same hive, different workflows. The decision rule comes down to install footprint, batchability, and where each one wins.

  2026-05-24