Eric Zimmermann Tools Complete Reference

@echo off
REM Complete EZ Tools parsing pipeline
REM %1 = KAPE triage directory (e.g., \\evidence-nas\CASE-xxx\hostname\triage)
REM %2 = Output directory

SET TRIAGE=%1
SET OUT=%2
SET EZ=C:\Tools\EZTools

if not exist %OUT% mkdir %OUT%

echo ==== EZ Tools Parsing Pipeline ====
echo Input:  %TRIAGE%
echo Output: %OUT%
echo.

REM MFT parsing
if exist "%TRIAGE%\C\$MFT" (
    echo [1/10] Parsing MFT...
    %EZ%\MFTECmd.exe -f "%TRIAGE%\C\$MFT" --csv "%OUT%\mft" --csvf MFT.csv
)

REM Prefetch
if exist "%TRIAGE%\C\Windows\Prefetch" (
    echo [2/10] Parsing Prefetch...
    %EZ%\PECmd.exe -d "%TRIAGE%\C\Windows\Prefetch" --csv "%OUT%\prefetch" --csvf Prefetch.csv -q
)

REM Shimcache (AppCompatCache in SYSTEM hive)
if exist "%TRIAGE%\C\Windows\System32\config\SYSTEM" (
    echo [3/10] Parsing Shimcache...
    %EZ%\AppCompatCacheParser.exe -f "%TRIAGE%\C\Windows\System32\config\SYSTEM" ^
        --csv "%OUT%\shimcache" --csvf Shimcache.csv
)

REM Amcache
if exist "%TRIAGE%\C\Windows\AppCompat\Programs\Amcache.hve" (
    echo [4/10] Parsing Amcache...
    %EZ%\AmcacheParser.exe -f "%TRIAGE%\C\Windows\AppCompat\Programs\Amcache.hve" ^
        --csv "%OUT%\amcache" --csvf Amcache.csv
)

REM LNK files
echo [5/10] Parsing LNK files...
%EZ%\LECmd.exe -d "%TRIAGE%\C\Users" -q ^
    --csv "%OUT%\lnk" --csvf LNKFiles.csv

REM Jump Lists
echo [6/10] Parsing Jump Lists...
%EZ%\JLECmd.exe -d "%TRIAGE%\C\Users" -q ^
    --csv "%OUT%\jumplists" --csvf JumpLists.csv

REM Shellbags
for /d %%u in ("%TRIAGE%\C\Users\*") do (
    if exist "%%u\AppData\Local\Microsoft\Windows\UsrClass.dat" (
        echo [7/10] Parsing Shellbags for %%~nxu...
        %EZ%\SBECmd.exe -d "%%u" --csv "%OUT%\shellbags" --csvf Shellbags-%%~nxu.csv
    )
)

REM Registry
if exist "%TRIAGE%\C\Windows\System32\config" (
    echo [8/10] Parsing Registry...
    %EZ%\RECmd.exe -d "%TRIAGE%\C\Windows\System32\config" ^
        --bn BatchExamples\Kroll_Batch.reb ^
        --csv "%OUT%\registry" --csvf Registry.csv
)

REM Event Logs
if exist "%TRIAGE%\C\Windows\System32\winevt\Logs" (
    echo [9/10] Parsing Event Logs...
    %EZ%\EvtxECmd.exe -d "%TRIAGE%\C\Windows\System32\winevt\Logs" ^
        --inc 4624,4625,4648,4688,4698,4720,4728,4732,7045,1102,4103,4104,5140 ^
        --csv "%OUT%\evtx" --csvf EventLogs.csv
)

REM SRUM
if exist "%TRIAGE%\C\Windows\System32\SRU\SRUDB.dat" (
    echo [10/10] Parsing SRUM...
    %EZ%\SrumECmd.exe -f "%TRIAGE%\C\Windows\System32\SRU\SRUDB.dat" ^
        --csv "%OUT%\srum" --csvf SRUM.csv
)

echo.
echo ==== Parsing Complete ====
echo Output files:
dir "%OUT%" /s /b *.csv

# After running ez-tools-pipeline.bat, analyze the output
$OUT = "D:\cases\CASE-2026-009\parsed"

# Build a combined execution timeline from multiple sources
$executionTimeline = [System.Collections.Generic.List[PSObject]]::new()

# Add Prefetch execution times
if (Test-Path "$OUT\prefetch\Prefetch.csv") {
    $pf = Import-Csv "$OUT\prefetch\Prefetch.csv"
    $pf | ForEach-Object {
        $name = $_.ExecutableName
        $_.RunTime1,$_.RunTime2,$_.RunTime3,$_.RunTime4,
        $_.RunTime5,$_.RunTime6,$_.RunTime7,$_.RunTime8 |
        Where-Object { $_ -ne "" } |
        ForEach-Object {
            $executionTimeline.Add([PSCustomObject]@{
                Time   = [DateTime]$_
                Source = "Prefetch"
                Name   = $name
                Path   = $null
            })
        }
    }
}

# Add Shimcache entries (file existence, not execution proof)
if (Test-Path "$OUT\shimcache\Shimcache.csv") {
    $shim = Import-Csv "$OUT\shimcache\Shimcache.csv"
    $shim | ForEach-Object {
        if ($_.LastModified -ne "") {
            $executionTimeline.Add([PSCustomObject]@{
                Time   = [DateTime]$_.LastModified
                Source = "Shimcache"
                Name   = (Split-Path $_.Path -Leaf)
                Path   = $_.Path
            })
        }
    }
}

# Sort by time and output
$executionTimeline |
    Sort-Object Time |
    Where-Object { $_.Time -gt [DateTime]"2026-09-17T00:00:00Z" } |
    Where-Object { $_.Time -lt [DateTime]"2026-09-18T00:00:00Z" } |
    Export-Csv "$OUT\execution-timeline-combined.csv" -NoTypeInformation