What's Eric Zimmerman's background?

Former FBI Special Agent specialising in digital forensics. After the FBI he joined Kroll, where he leads tooling for the firm's incident response practice as a Senior Director.

Where do I get his tools?

https://ericzimmerman.github.io. The Get-ZimmermanTools.ps1 installer downloads the whole suite and keeps it updated. See the AmcacheParser download guide for verification patterns and air-gapped installs.

Does Eric teach courses?

Yes. He teaches SANS FOR498 (Battlefield Forensics & Data Acquisition) and contributes to FOR500 (Windows Forensic Analysis). The SANS DFIR curriculum uses his suite throughout.

Is AmcacheParser officially supported by Microsoft?

No. It's independent open-source tooling. Microsoft does not officially document Amcache internals. The schema knowledge baked into AmcacheParser came from years of reverse engineering by Willi Ballenthin, Yogesh Khatri, Maxim Suhanov, and others.

When did AmcacheParser first ship?

Around 2014, alongside the rest of the Zimmerman tools. The modern Inventory* schema arrived in Windows 10 build 1709 (2017) and current AmcacheParser builds primarily target it.

Who created AmcacheParser?

Eric Zimmerman wrote it. Ex-FBI Special Agent, currently Senior Director at Kroll, and the person who has done more to standardise Windows DFIR tooling than anyone else in the last decade. He maintains AmcacheParser as part of a suite hosted at ericzimmerman.github.io.

If you have done a Windows triage in the last ten years, you have either run his tools directly or used a product that calls them. KAPE wraps them. Velociraptor's Windows artifacts use them. SANS teaches with them. The Zimmerman suite is the de facto standard Windows DFIR toolset.

Background#

Former FBI Special Agent specialising in digital forensics.
Currently Senior Director at Kroll, leading tooling for the firm's incident response practice.
SANS instructor for FOR498 (Battlefield Forensics) and contributor to FOR500 (Windows Forensic Analysis).
Long history of conference talks, blog posts, and active engagement on community channels.

The suite#

AmcacheParser is one of about a dozen tools in the suite:

Tool	Parses
AmcacheParser	`Amcache.hve`
MFTECmd	`$MFT`, `$LogFile`, `$J`, `$Boot`, `$SDS`
RECmd	Any registry hive (batch processor)
RBCmd	Recycle Bin (`$I*` files)
PECmd	Windows Prefetch
EvtxECmd	Windows Event Logs (.evtx)
JLECmd	Jump Lists
LECmd	Windows LNK files
SBECmd	Shellbags
AppCompatCacheParser	Shimcache
SrumECmd	SRUM (`SRUDB.dat`)

All MIT-licensed. All free for commercial use. All produce structured CSV that loads cleanly into Eric's companion Timeline Explorer GUI. This site does not host any of them. If you want to look at the neighbouring artifacts without installing anything, there are independent browser-based tools such as a Shimcache parser and a Prefetch parser, which are not Eric's work either.

Installing the suite#

Official installer:

mkdir C:\Tools\ZTools
cd    C:\Tools\ZTools
Invoke-WebRequest `
  -Uri 'https://raw.githubusercontent.com/EricZimmerman/Get-ZimmermanTools/master/Get-ZimmermanTools.ps1' `
  -OutFile Get-ZimmermanTools.ps1
.\Get-ZimmermanTools.ps1 -Dest C:\Tools\ZTools -NetVersion 6

Re-run periodically to stay current. For verification patterns and mirror configuration, see the AmcacheParser download guide.

Is this site Eric's?#

No. The browser parser at amcacheparser.com is an independent re-implementation of the Amcache read path in Rust + WebAssembly, designed for triage and education. Not affiliated with Eric or Kroll.

Credit is given throughout because the original AmcacheParser.exe and Eric's decade of public schema work made it possible.

Who created AmcacheParser?

Background#

The suite#

Installing the suite#

Is this site Eric's?#

Related#

Related posts