Creative Design & Branding

Parsing Artifacts With Eric Zimmerman Tools

The skill parses Windows forensic artifacts—including $MFT/$J, Prefetch, registry hives, shellbags, and Amcache—into normalized CSV or JSON with Eric Zimmerman’s EZ Tools. It then loads the results into Timeline Explorer, enabling DFIR and incident‑response teams to establish program execution, file access, and persistence evidence from acquired forensic images. The workflow is ideal after triage collection with tools such as KAPE.

Publisher / source

Cybersecurity Skills (Community)

Upstream record

mukul975/Anthropic-Cybersecurity-Skills

Version

Version 3

Published

2026-06-23

Publication review

Approved for publication

Content fingerprint

dd4a0cc46223c8e3ac6d482495898f24c24a0bda01bd4a4f525a589e79605817