Incident response follows a lifecycle, usually described in six phases. This page focuses on the technical middle of that lifecycle — collecting, parsing and analyzing evidence — and maps free/open-source tools to each step. If you're coming from a unified platform like AXIOM, the shift is that these tools are single-purpose and chained by hand.
The tool stages below (Collection, Parsing, Analysis, Memory) sit inside Identification — figuring out what happened, when, and how.
01 Collection
Grab the right artifacts off a live system or image before anything else.
KAPE
Targets pull relevant artifacts, modules run parsers on them automatically — KAPE can chain most of the tools in the next stage as part of the same collection run, not just as separate steps.
02 Parsing
Turn raw artifacts into readable, filterable output — usually CSV. Learn these standalone first so you know what KAPE's modules are actually doing under the hood.
MFTECmd
Parses the $MFT into a CSV timeline. Usually the first parser you'll reach for.
Registry Explorer
GUI hive browser with bookmarks for common keys — run history, USB devices, network profiles.
EvtxECmd
Parses Windows Event Logs to CSV/JSON, with maps for common event IDs.
RECmd
Batch registry parser driven by community-maintained "RECmd batch files" — pulls run keys, USB history, network profiles and more in one pass.
AmcacheParser
Parses Amcache.hve for evidence of program execution, including deleted or renamed binaries.
JLECmd / LECmd
Jump lists and LNK files — recent files, mapped network locations, removable media use.
PECmd
Prefetch parser — execution count and first/last run times for programs.
SBECmd
ShellBags — folder access history, including from deleted or removable volumes.
SrumECmd
System Resource Usage Monitor — process execution, network usage and app activity over time.
WxTCmd
Windows Timeline / ActivitiesCache.db — cross-device user activity history.
This covers the core artifacts. The EZ Tools suite has more (browser history, SQLite, bookmarks) — see the full index.
03 Analysis
Combine parsed output into a single timeline, spot what matters, and triage logs at scale.
Timeline Explorer
Fast CSV/Excel viewer built for the volume EZ Tools output produces — filter, group, tag.
Hayabusa
Fast Windows Event Log triage with built-in detection rules — produces a timeline straight from EVTX.
Chainsaw
Rapid EVTX/log triage for a first-pass sweep — surfaces likely-malicious events without a full parse.
IRFlow Timeline
Native macOS-only timeline analyzer — a "Timeline Explorer" style experience for Mac users, without needing a Windows VM.
Autopsy
Free GUI case platform if you want a single-pane view closer to what AXIOM gives you.
04 Memory
When disk artifacts aren't enough — processes, network state, injected code.
Volatility 3
The standard for memory image analysis. Steeper learning curve — save this for last.
Further learning
- 13Cubed (YouTube) — hands-on walkthroughs of KAPE and each EZ Tool, free.
- SANS FOR500 / FOR508 posters and cheat sheets — the official KAPE/EZ Tools targets-and-modules reference.
- Eric Zimmerman's own docs — authoritative on flags and switches for each tool.
- IRFlow's KAPE Triage Workflow — from collection through timeline analysis.
- ForensicFocus — DFIR news, technique write-ups and community forums.