Lecmd
Parse and extract Windows shortcut (.lnk) files using Eric Zimmerman's LECmd. Covers CLI flags, output formats (CSV/JSON/XML/HTML), removable drive filtering, and output field reference.
Sqlecmd
Parse and extract data from SQLite databases using Eric Zimmerman's SQLECmd. Covers CLI flags, map-driven extraction, output formats (CSV/JSON), blob export, and map structure reference.
Rbcmd
Parse and extract Windows Recycle Bin artifacts ($I files and INFO2) using Eric Zimmerman's RBCmd. Covers CLI flags, CSV output, and output field reference.
Recentfilecacheparser
Parse and extract Windows RecentFileCache.bcf files using Eric Zimmerman's RecentFileCacheParser. Covers CLI flags, output formats (CSV/JSON), and output field reference.
Evtxecmd
Parse and extract Windows Event Log (.evtx) files using Eric Zimmerman's EvtxECmd. Covers CLI flags, output formats (CSV/JSON/XML), event filtering, Volume Shadow Copy support, and the map system.
Mftecmd
Parse and extract NTFS artifacts ($MFT, $J USN Journal, $Boot, $SDS, $I30) using Eric Zimmerman's MFTECmd. Covers CLI flags, output formats (CSV/JSON/bodyfile), and output field reference.
Sumecmd
Parse and extract Windows User Access Logging (UAL) databases using Eric Zimmerman's SumECmd. Covers CLI flags, CSV output, and output field reference for client access, DNS, role access, and VM entries.
Sbecmd
Parse and extract Windows ShellBags data from registry hives using Eric Zimmerman's SBECmd. Covers CLI flags, CSV output, deduplication, timezone support, and output field reference.
Jlecmd
Parse and extract Windows Jump List files (AutomaticDestinations and CustomDestinations) using Eric Zimmerman's JLECmd. Covers CLI flags, output formats (CSV/JSON/HTML), AppID mappings, and output field reference.
Srumecmd
Parse and extract Windows SRUM (System Resource Usage Monitor) database using Eric Zimmerman's SrumECmd. Covers CLI flags, CSV output, and output field reference for application resource usage, network usage, network connections, energy usage, push notifications, and timeline data.
Amcacheparser
Parse and extract Windows Amcache.hve registry hive using Eric Zimmerman's AmcacheParser. Covers CLI flags, output formats (CSV), SHA-1 filtering, and output field reference for file entries, program entries, device data, and driver information.
Appcompatcacheparser
Parse and extract Windows Application Compatibility Cache (ShimCache) from SYSTEM registry hive using Eric Zimmerman's AppCompatCacheParser. Covers CLI flags, CSV output, ControlSet selection, and output field reference.
Recmd
Parse and extract Windows Registry hive data using Eric Zimmerman's RECmd. Covers CLI flags, batch mode, search mode, output formats (CSV/JSON), key/value queries, deleted key recovery, and output field reference.
Pecmd
Parse and extract Windows Prefetch (.pf) files using Eric Zimmerman's PECmd. Covers CLI flags, output formats (CSV/JSON/HTML), keyword highlighting, and output field reference.