15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite

15.3 Specialized DFIR Utilities: Eric Zimmerman Tools & Sysinternals Suite

Quick Answer: Modern digital forensics and incident response (DFIR) relies heavily on agile, specialized command-line utilities for rapid artifact parsing and live system analysis. Eric Zimmerman's Tools (EZ Tools) are high-performance, open-source .NET utilities designed to parse proprietary Windows forensic artifacts, including registry transaction logs (Registry Explorer / RECmd), NTFS metadata (MFTECmd for $MFT, $LogFile, and $J), folder navigation (ShellBags Explorer / SBECmd), and execution artifacts (PECmd, AppCompatCacheParser, AmcacheParser, LECmd, JLECmd, and EvtxECmd). These tools are orchestrated by KAPE (Kroll Artifact Parser and Extractor), which automates triage by pairing Targets (.tkape) for file collection with Modules (.mkape) for tool execution. For live endpoint triage, the Microsoft Sysinternals Suite—including Autoruns (autorunsc.exe), Process Monitor (Procmon), Process Explorer (Procexp), and PsTools—provides deep visibility into autostart persistence, process parentage, active network sockets, and kernel activity.

---

Eric Zimmerman's DFIR Tools (EZ Tools)

Authored by former FBI Special Agent Eric Zimmerman, EZ Tools represent the gold standard for Windows artifact analysis. Developed in C#/.NET, these utilities provide both rich graphical interfaces and command-line variants optimized for automated incident response pipelines.

1. Registry Forensics: Registry Explorer & RECmd

• Registry Explorer (GUI): Offline hive viewer supporting transaction log replay (.LOG1 / .LOG2). When a system crashes or is abruptly imaged, registry hives remain in a "dirty" state. Registry Explorer reconciles uncommitted transactions, recovers deleted registry keys, and provides built-in bookmarks for critical forensic paths.
• RECmd (Registry Explorer Command Line): Designed for headless automation. Supports batch files (.reb) to query hundreds of forensic registry locations across multiple hives simultaneously, exporting structured CSV/JSON results.

:: Running RECmd in batch mode against seized registry hives
RECmd.exe -d "C:\Cases\Evidence\RegistryHives" --bn "BatchExamples\Kroll_Batch.reb" --csv "C:\Cases\Output\Registry"

2. File System Parsers: MFTECmd & ShellBags Explorer

• MFTECmd (MFT, LogFile, USN Journal, and Boot Parser):
  • Parses NTFS Master File Table ($MFT) records, extracting record numbers, sequence numbers, parent directory references, file sizes, and flags (directory vs. file; allocated vs. unallocated).
  • Timestomp Detection: Compares timestamps in $STANDARD_INFORMATION (modifiable by user-mode APIs) against $FILE_NAME (modified only by the Windows kernel), immediately highlighting timestomping anomalies.
  • Analyzes the USN Change Journal ($J), documenting file creation, renaming, deletion, and extension modification events alongside reason codes (USN_REASON_FILE_CREATE, USN_REASON_FILE_DELETE).
  • Analyzes $LogFile (NTFS transaction journal) and $Boot (Volume Boot Record parameters).

:: Parsing $MFT and $J to CSV format using MFTECmd
MFTECmd.exe -f "C:\Evidence\$MFT" --csv "C:\Output\MFT" --csvf mft_parsed.csv
MFTECmd.exe -f "C:\Evidence\$Extend\$UsnJrnl:$J" --csv "C:\Output\USN" --csvf usn_parsed.csv

• ShellBags Explorer & SBECmd:
  • Parses BagMRU and Bags keys from NTUSER.DAT and UsrClass.dat.
  • Forensic Utility: Proves user folder browsing activity. Reconstructs folder navigation histories, identifying when a suspect opened local folders, mounted network shares, browsed removable media, or explored ZIP archives—even if those directories have been permanently deleted.

3. Execution and User Activity Parsers

---

KAPE (Kroll Artifact Parser and Extractor)

Developed by Eric Zimmerman while at Kroll, KAPE revolutionized digital forensics incident response by automating targeted forensic triage.

The Triage-First Philosophy

Traditional bit-stream disk imaging of modern multi-terabyte drives can take 4 to 8 hours per endpoint. However, in 95% of cyber incident response cases, critical evidentiary artifacts reside within a tiny fraction of the disk (less than 5 GB). KAPE enables investigators to acquire and process this critical evidence in 3 to 5 minutes.

[Live Host / Mounted Evidence Image]
                 │
                 ▼
   ┌───────────────────────────┐
   │      KAPE Targets         │ ──> Reads Target Files (.tkape)
   │  (Evidence Collector)     │ ──> Extracts MFT, Registry, Event Logs,
   └───────────────────────────┘     Prefetch, LNK, Browsers via VSS
                 │
                 ▼  (Raw Targeted Artifacts)
   ┌───────────────────────────┐
   │      KAPE Modules         │ ──> Reads Module Files (.mkape)
   │   (Automated Parsers)     │ ──> Executes MFTECmd, PECmd, EvtxECmd,
   └───────────────────────────┘     RECmd, Eric Zimmerman CLI Suite
                 │
                 ▼
   ┌───────────────────────────┐
   │ Parsed Structured Output  │ ──> Structured CSV, JSON, Timeline
   │ (CSV / JSON / Storage)    │ ──> Optional SFTP / AWS S3 Exfiltration
   └───────────────────────────┘

Targets (.tkape) vs. Modules (.mkape)

1. Targets (.tkape): Plain-text YAML configuration files that specify what files and directories to collect. Targets define file paths, recursive directory masks, and file extensions. Compound targets (e.g., KapeTriage.tkape) group multiple sub-targets including Registry hives, Event Logs, LNK files, Prefetch, Jump Lists, and browser histories.
2. Modules (.mkape): Plain-text YAML configuration files that specify what command-line tools to execute against the collected files. Modules define the executable path, command-line arguments, output format, and output directory. Examples include MFTECmd.mkape, PECmd.mkape, and EvtxECmd.mkape.

Advanced KAPE Features

• Volume Shadow Copy Service (--vss): When executed against a live Windows endpoint with administrator privileges, KAPE automatically mounts and enumerates all historical Volume Shadow Copies, extracting historical versions of registry hives and event logs from past snapshots.
• Direct Cloud Exfiltration: KAPE can automatically package parsed triage output into a password-protected zip file and transfer it to an SFTP server, AWS S3 bucket, or Azure Blob container for remote incident response.

:: High-speed live triage acquisition and processing using KAPE
kape.exe --tsource C: --tdest D:\Triage\Targets --target KapeTriage \
         --msource D:\Triage\Targets --mdest D:\Triage\Parsed --module ZimmermanTools \
         --vss --gui

---

Microsoft Sysinternals Suite in DFIR

Originally created by Mark Russinovich and Bryce Cogswell (Winternals, later acquired by Microsoft), the Windows Sysinternals Suite is a collection of advanced system utilities used extensively by forensic examiners and incident responders for live system analysis.

1. Autoruns & autorunsc.exe (Persistence Auditing)

Threat actors maintain persistence on Windows hosts using Autostart Extensibility Points (ASEPs). Autoruns is the most comprehensive ASEP inspector available for Windows.

• Scope of Coverage: Inspects standard Run/RunOnce registry keys, Startup folders, Scheduled Tasks, Windows Services, Drivers, Winlogon extensions, AppInit_DLLs, Image File Execution Options (IFEO debugger hijacks), WMI Event Consumers, Print Monitors, and Explorer Shell Extensions.
• Forensic Verification Flags:
  • -v: Verifies digital signatures against trusted root certificates.
  • -vt: Computes cryptographic file hashes and submits them automatically to the VirusTotal API, displaying detection ratios.
  • -c: Outputs results as comma-separated values (CSV) for scripting.
  • -a *: Evaluates all ASEP categories.

:: Automated baseline audit of all autostart mechanisms with VirusTotal checks
autorunsc.exe -a * -c -h -v -vt > C:\Forensics\autoruns_audit.csv

2. Process Monitor (Procmon)

Process Monitor is an advanced monitoring tool for Windows that captures real-time file system, registry, process, thread, and network activity.

• Core Operations Captured: RegSetValue, RegDeleteKey, CreateFile, WriteFile, ProcessCreate, and TCP Connect.
• Forensic Capture Strategies: In intensive environments, capturing all events can rapidly consume gigabytes of RAM. Examiners configure Drop Filtered Events to discard benign operations in memory and use Backing Files (/BackingFile <path.pml>) to write capture logs directly to secondary storage.

:: Starting headless Process Monitor capture with backing file
procmon64.exe /BackingFile D:\IncidentCapture.pml /Quiet /AcceptEula

:: Terminating active capture and converting PML to CSV
procmon64.exe /Terminate
procmon64.exe /OpenLog D:\IncidentCapture.pml /SaveAs D:\IncidentCapture.csv

3. Process Explorer (Procexp)

Process Explorer functions as an advanced task manager, displaying a real-time hierarchical tree of active processes.

• Parent-Child Process Trees: Instantly exposes anomalous process hierarchies (e.g., cmd.exe or powershell.exe spawned as a child of Microsoft Word (winword.exe) or IIS Worker Process (w3wp.exe)).
• Handle and DLL Inspection: Displays all active file handles, named pipes, mutexes, and loaded dynamic link libraries (DLLs) mapped into a process's virtual address space.
• Process Hollowing & Injection Detection: Compares strings resident within the executable on disk against strings present in physical RAM. Discrepancies strongly indicate process hollowing or in-memory code injection.
• VirusTotal Integration: Enables instant hashing and VirusTotal reputation scoring of all running processes.

4. TCPView

TCPView monitors active network sockets on the endpoint, displaying detailed listings of all TCP and UDP endpoints, local addresses, remote addresses, port numbers, connection state (LISTENING, ESTABLISHED, TIME_WAIT), and the owning process name and PID. It highlights active state transitions using color coding (green for new connections, red for terminated sockets, yellow for state changes).

5. PsTools Suite

• PsExec: Remote execution utility allowing administrators—and incident responders—to spawn command shells or execute triage scripts on remote systems without installing a full agent.
  • Forensic Footprint: Creates PSEXESVC.exe in %SystemRoot%, generates Windows System Event Log ID 7045 (A service was installed in the system), and creates named pipes (\pipe\psexec*).
• PsList: Displays detailed process lists, thread counts, memory usage, and execution times locally or remotely.
• PsLoggedOn: Queries the local registry and network resource shares to identify active interactive users and remote session connections.

6. Strings (strings.exe)

Extracts printable characters from binary files, memory dumps, or unallocated space:

:: Extracting ASCII and Unicode strings with minimum length of 8 characters
strings.exe -a -u -n 8 suspect_memory.dmp > memory_strings.txt

7. SDelete (sdelete.exe)

Developed as a secure file deletion and free-space sanitization utility compliant with DoD 5220.22-M standards. In forensic investigations, threat actors frequently employ sdelete.exe as an anti-forensics tool.

• Forensic Detection: When sdelete.exe deletes a file, it renames the file entry in the Master File Table to a sequence of repeating characters (such as AAA...AAA) prior to zeroing out cluster runs and unlinking the MFT record. Identifying these repeating character patterns in MFT records or USN Journal entries provides definitive proof of deliberate evidence destruction.