Who created AmcacheParser?

Eric Zimmerman wrote it. Ex-FBI Special Agent, currently Senior Director at Kroll, and the person who has done more to standardise Windows DFIR tooling than anyone else in the last decade. He maintains AmcacheParser as part of a suite hosted at ericzimmerman.github.io.

If you have done a Windows triage in the last ten years, you have either run his tools directly or used a product that calls them. KAPE wraps them. Velociraptor's Windows artifacts use them. SANS teaches with them. The Zimmerman suite is the de facto standard Windows DFIR toolset.

Background#

  • Former FBI Special Agent specialising in digital forensics.
  • Currently Senior Director at Kroll, leading tooling for the firm's incident response practice.
  • SANS instructor for FOR498 (Battlefield Forensics) and contributor to FOR500 (Windows Forensic Analysis).
  • Long history of conference talks, blog posts, and active engagement on community channels.

The suite#

AmcacheParser is one of about a dozen tools in the suite:

Tool Parses
AmcacheParser Amcache.hve
MFTECmd $MFT, $LogFile, $J, $Boot, $SDS
RECmd Any registry hive (batch processor)
RBCmd Recycle Bin ($I* files)
PECmd Windows Prefetch
EvtxECmd Windows Event Logs (.evtx)
JLECmd Jump Lists
LECmd Windows LNK files
SBECmd Shellbags
AppCompatCacheParser Shimcache
SrumECmd SRUM (SRUDB.dat)

All MIT-licensed. All free for commercial use. All produce structured CSV that loads cleanly into Eric's companion Timeline Explorer GUI.

Installing the suite#

Official installer:

mkdir C:\Tools\ZTools
cd    C:\Tools\ZTools
Invoke-WebRequest `
  -Uri 'https://raw.githubusercontent.com/EricZimmerman/Get-ZimmermanTools/master/Get-ZimmermanTools.ps1' `
  -OutFile Get-ZimmermanTools.ps1
.\Get-ZimmermanTools.ps1 -Dest C:\Tools\ZTools -NetVersion 6

Re-run periodically to stay current. For verification patterns and mirror configuration, see the AmcacheParser download guide.

Is this site Eric's?#

No. The browser parser at amcacheparser.com is an independent re-implementation of the Amcache read path in Rust + WebAssembly, designed for triage and education. Not affiliated with Eric or Kroll.

Credit is given throughout because the original AmcacheParser.exe and Eric's decade of public schema work made it possible.

Tagsqaamcacheparsereric-zimmerman

Related posts

  • Is AmcacheParser free?

    Yes. MIT-licensed, free for any use including commercial DFIR. The rest of Eric Zimmerman's tools too.

  • Why is my Amcache.hve empty?

    Three causes in order of frequency: appraiser disabled, host freshly imaged, or you're on a Server where the cadence is naturally slow. Tampering is a distant fourth.

  • Where is the Amcache registry key?

    Amcache is its own hive file, not a key under HKLM. Loaded on demand by the appraiser. Mounts at HKLM\Amcache when active.

  • What does Amcache.hve contain?

    Inventory records for every PE, driver, application, and connected device the Compatibility Appraiser has seen. SHA-1, full path, publisher, and timestamps per entry.

← Back to all posts