The NEW EZ Tools Command-Line Poster has been released!
Forensics the EZ Way! With the wealth of data stored on Windows computers it is often difficult to know where to start. If you encounter a sizable hard drive, it could be hours or even days before you’re ready to even start your investigation, much less report the results. EZ Tools enables you to provide scriptable, scalable, and repeatable results with astonishing speed and accuracy. Go from one investigation a week to several per day. This type of performance is common with the command-line versions of EZ Tools, and this poster will show you how to use them.
Tips for Using EZTools
Eric Zimmerman's open source tools can be used in a wide variety of investigations including cross-validation of tools, providing insight into technical details not exposed by other tools, and more. Eric's first Cheat Sheet contains usage for tools for lnk files, jump lists, prefetch, and other artifacts related to evidence of execution. Listen to Eric as he walks you through a Cheat Sheet created to help you maximize the capabilities of his tools.
Requirements and Troubleshooting
- All software requires at least Microsoft .net 4.6.2 or newer! You will get errors running these without at least 4.6.2. When in doubt, install it!
- DO NOT RUN ANYTHING FOUND HERE FROM 'C:\PROGRAM FILES' DIRECTORY (unless you run them as administrator)!
- DO NOT USE WINDOWS TO EXTRACT THINGS. Use 7-Zip or Winrar as Windows will block the DLLs!
- All software is digitally signed. Once you verify the signature as coming from me, any anti-virus hits are false positives. When in doubt, download the files directly from here!
- If you get DPI scaling issues, make a shortcut (or directly against the exe), edit the properties, then click Compatibility. Under Change high DPI settings, check Override high DPI scaling behavior at bottom and choose System, then click OK out of the dialog
.png "Anastasia Sentsova")
