TZWorks LLC Downloads for Forensic tools

Artifact Analysis Registry/Event Analysis NTFS Analysis Network Utilities PE Utilities Miscellaneous

Artifact Analysis (top)

Windows Prefetch Parser (pf)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	pf32.v.1.40.win.zip	pf64.v.1.40.win.zip	pf64a.v.1.40.win.zip	md5/sha1
Linux:	pf32.v.1.40.lin.tar.gz*	pf64.v.1.40.lin.tar.gz	pf64a.v.1.40.lin.tar.gz	md5/sha1
macOS:	Not Available	pf.v.1.40.dmg	pf.v.1.40.dmg	md5/sha1

Windows 'index.dat' Parser (id)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	id32.v.0.93.win.zip	id64.v.0.93.win.zip	id64a.v.0.93.win.zip	md5/sha1
Linux:	id32.v.0.93.lin.tar.gz*	id64.v.0.93.lin.tar.gz	id64a.v.0.93.lin.tar.gz	md5/sha1
macOS:	Not Available	id.v.0.93.dmg	id.v.0.93.dmg	md5/sha1

Windows LNK Parsing Utility (lp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	lp32.v.1.08.win.zip	lp64.v.1.08.win.zip	lp64a.v.1.08.win.zip	md5/sha1
Linux:	lp32.v.1.08.lin.tar.gz*	lp64.v.1.08.lin.tar.gz	lp64a.v.1.08.lin.tar.gz	md5/sha1
macOS:	Not Available	lp.v.1.08.dmg	lp.v.1.08.dmg	md5/sha1

Windows USB Storage Parser (usp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	usp32.v.0.80.win.zip	usp64.v.0.80.win.zip	usp64a.v.0.80.win.zip	md5/sha1
Linux:	usp32.v.0.80.lin.tar.gz*	usp64.v.0.80.lin.tar.gz	usp64a.v.0.80.lin.tar.gz	md5/sha1
macOS:	Not Available	usp.v.0.80.dmg	usp.v.0.80.dmg	md5/sha1

Timeline ActivitiesCache Parser (tac)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	tac32.v.0.35.win.zip	tac64.v.0.35.win.zip	tac64a.v.0.35.win.zip	md5/sha1
Linux:	tac32.v.0.35.lin.tar.gz*	tac64.v.0.35.lin.tar.gz	tac64a.v.0.35.lin.tar.gz	md5/sha1
macOS:	Not Available	tac.v.0.35.dmg	tac.v.0.35.dmg	md5/sha1

Windows Jump List Parser (jmp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	jmp32.v.0.64.win.zip	jmp64.v.0.64.win.zip	jmp64a.v.0.64.win.zip	md5/sha1
Linux:	jmp32.v.0.64.lin.tar.gz*	jmp64.v.0.64.lin.tar.gz	jmp64a.v.0.64.lin.tar.gz	md5/sha1
macOS:	Not Available	jmp.v.0.64.dmg	jmp.v.0.64.dmg	md5/sha1

Windows Shim Database (SDB) Parser (shims)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	shims32.v.0.45.win.zip	shims64.v.0.45.win.zip	shims64a.v.0.45.win.zip	md5/sha1
Linux:	shims32.v.0.45.lin.tar.gz*	shims64.v.0.45.lin.tar.gz	shims64a.v.0.45.lin.tar.gz	md5/sha1
macOS:	Not Available	shims.v.0.45.dmg	shims.v.0.45.dmg	md5/sha1

Trash Inspection & Analysis (tia)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	tia32.v.0.37.win.zip	tia64.v.0.37.win.zip	tia64a.v.0.37.win.zip	md5/sha1
Linux:	tia32.v.0.37.lin.tar.gz*	tia64.v.0.37.lin.tar.gz	tia64a.v.0.37.lin.tar.gz	md5/sha1
macOS:	Not Available	tia.v.0.37.dmg	tia.v.0.37.dmg	md5/sha1

Safari Artifact Parser (sap)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	sap32.v.0.19.win.zip	sap64.v.0.19.win.zip	sap64a.v.0.19.win.zip	md5/sha1
Linux:	sap32.v.0.19.lin.tar.gz*	sap64.v.0.19.lin.tar.gz	sap64a.v.0.19.lin.tar.gz	md5/sha1
macOS:	Not Available	sap.v.0.19.dmg	sap.v.0.19.dmg	md5/sha1

Windows Push Notification DB Parser (wpn)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	wpn32.v.0.31.win.zip	wpn64.v.0.31.win.zip	wpn64a.v.0.31.win.zip	md5/sha1
Linux:	wpn32.v.0.31.lin.tar.gz*	wpn64.v.0.31.lin.tar.gz	wpn64a.v.0.31.lin.tar.gz	md5/sha1
macOS:	Not Available	wpn.v.0.31.dmg	wpn.v.0.31.dmg	md5/sha1

MS Office Backstage Parser (bs)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	bs32.v.0.23.win.zip	bs64.v.0.23.win.zip	bs64a.v.0.23.win.zip	md5/sha1
Linux:	bs32.v.0.23.lin.tar.gz*	bs64.v.0.23.lin.tar.gz	bs64a.v.0.23.lin.tar.gz	md5/sha1
macOS:	Not Available	bs.v.0.23.dmg	bs.v.0.23.dmg	md5/sha1

Chromium SQLite Parser (csp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	csp32.v.0.27.win.zip	csp64.v.0.27.win.zip	csp64a.v.0.27.win.zip	md5/sha1
Linux:	csp32.v.0.27.lin.tar.gz*	csp64.v.0.27.lin.tar.gz	csp64a.v.0.27.lin.tar.gz	md5/sha1
macOS:	Not Available	csp.v.0.27.dmg	csp.v.0.27.dmg	md5/sha1

Mozilla SQLite Parser (msp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	msp32.v.0.21.win.zip	msp64.v.0.21.win.zip	msp64a.v.0.21.win.zip	md5/sha1
Linux:	msp32.v.0.21.lin.tar.gz*	msp64.v.0.21.lin.tar.gz	msp64a.v.0.21.lin.tar.gz	md5/sha1
macOS:	Not Available	msp.v.0.21.dmg	msp.v.0.21.dmg	md5/sha1

Mozilla Cache Parser (mcp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	mcp32.v.0.23.win.zip	mcp64.v.0.23.win.zip	mcp64a.v.0.23.win.zip	md5/sha1
Linux:	mcp32.v.0.23.lin.tar.gz*	mcp64.v.0.23.lin.tar.gz	mcp64a.v.0.23.lin.tar.gz	md5/sha1
macOS:	Not Available	mcp.v.0.23.dmg	mcp.v.0.23.dmg	md5/sha1

Chromium Cache Parser (ccp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	ccp32.v.0.16.win.zip	ccp64.v.0.16.win.zip	ccp64a.v.0.16.win.zip	md5/sha1
Linux:	ccp32.v.0.16.lin.tar.gz*	ccp64.v.0.16.lin.tar.gz	ccp64a.v.0.16.lin.tar.gz	md5/sha1
macOS:	Not Available	ccp.v.0.16.dmg	ccp.v.0.16.dmg	md5/sha1

FAT32 & exFAT Analysis (fata)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	fata32.v.0.13.win.zip	fata64.v.0.13.win.zip	fata64a.v.0.13.win.zip	md5/sha1
Linux:	fata32.v.0.13.lin.tar.gz*	fata64.v.0.13.lin.tar.gz	fata64a.v.0.13.lin.tar.gz	md5/sha1
macOS:	Not Available	fata.v.0.13.dmg	fata.v.0.13.dmg	md5/sha1

Registry and Event Log Analysis (top)

Yet Another Registry Utility (yaru)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	yaru32.v.1.91.win.zip	yaru64.v.1.91.win.zip	yaru64a.v.1.91.win.zip	md5/sha1
Linux:	yaru32.v.1.91.lin.tar.gz*	yaru64.v.1.91.lin.tar.gz	yaru64a.v.1.91.lin.tar.gz	md5/sha1
macOS:	Not Available	yaru.v.1.91.dmg	yaru.v.1.91.dmg	md5/sha1

Windows Event Log Viewer (evtx_view)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	evtx_view32.v.1.22.win.zip	evtx_view64.v.1.22.win.zip	evtx_view64a.v.1.22.win.zip	md5/sha1
Linux:	evtx_view32.v.1.22.lin.tar.gz*	evtx_view64.v.1.22.lin.tar.gz	evtx_view64a.v.1.22.lin.tar.gz	md5/sha1
macOS:	Not Available	evtx_view.v.1.22.dmg	evtx_view.v.1.22.dmg	md5/sha1

Windows ShellBag Parser (sbag)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	sbag32.v.0.80.win.zip	sbag64.v.0.80.win.zip	sbag64a.v.0.80.win.zip	md5/sha1
Linux:	sbag32.v.0.80.lin.tar.gz*	sbag64.v.0.80.lin.tar.gz	sbag64a.v.0.80.lin.tar.gz	md5/sha1
macOS:	Not Available	sbag.v.0.80.dmg	sbag.v.0.80.dmg	md5/sha1

Computer Account Forensic Artifact Extractor (cafae)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	cafae32.v.0.80.win.zip	cafae64.v.0.80.win.zip	cafae64a.v.0.80.win.zip	md5/sha1
Linux:	cafae32.v.0.80.lin.tar.gz*	cafae64.v.0.80.lin.tar.gz	cafae64a.v.0.80.lin.tar.gz	md5/sha1
macOS:	Not Available	cafae.v.0.80.dmg	cafae.v.0.80.dmg	md5/sha1

Windows Event Log Parser (evtwalk)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	evtwalk32.v.0.65.win.zip	evtwalk64.v.0.65.win.zip	evtwalk64a.v.0.65.win.zip	md5/sha1
Linux:	evtwalk32.v.0.65.lin.tar.gz*	evtwalk64.v.0.65.lin.tar.gz	evtwalk64a.v.0.65.lin.tar.gz	md5/sha1
macOS:	Not Available	evtwalk.v.0.65.dmg	evtwalk.v.0.65.dmg	md5/sha1

Windows AppCompatibility Cache Utility (wacu)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	wacu32.v.0.53.win.zip	wacu64.v.0.53.win.zip	wacu64a.v.0.53.win.zip	md5/sha1
Linux:	wacu32.v.0.53.lin.tar.gz*	wacu64.v.0.53.lin.tar.gz	wacu64a.v.0.53.lin.tar.gz	md5/sha1
macOS:	Not Available	wacu.v.0.53.dmg	wacu.v.0.53.dmg	md5/sha1

Event Log MessageTables Offline (elmo)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	elmo32.v.0.46.win.zip	elmo64.v.0.46.win.zip	elmo64a.v.0.46.win.zip	md5/sha1
Linux:	elmo32.v.0.46.lin.tar.gz*	elmo64.v.0.46.lin.tar.gz	elmo64a.v.0.46.lin.tar.gz	md5/sha1
macOS:	Not Available	elmo.v.0.46.dmg	elmo.v.0.46.dmg	md5/sha1

Trace Event Log and Analysis (tela)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	tela32.v.0.31.win.zip	tela64.v.0.31.win.zip	tela64a.v.0.31.win.zip	md5/sha1
Linux:	tela32.v.0.31.lin.tar.gz*	tela64.v.0.31.lin.tar.gz	tela64a.v.0.31.lin.tar.gz	md5/sha1
macOS:	Not Available	tela.v.0.31.dmg	tela.v.0.31.dmg	md5/sha1

Windows EVTX Fragment eXtension Parser (evtfx)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	evtfx32.v.0.17.win.zip	evtfx64.v.0.17.win.zip	evtfx64a.v.0.17.win.zip	md5/sha1
Linux:	evtfx32.v.0.17.lin.tar.gz*	evtfx64.v.0.17.lin.tar.gz	evtfx64a.v.0.17.lin.tar.gz	md5/sha1
macOS:	Not Available	evtfx.v.0.17.dmg	evtfx.v.0.17.dmg	md5/sha1

NTFS Filesystem Analysis (top)

Windows Journal Parser (jp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	jp32.v.1.50.win.zip	jp64.v.1.50.win.zip	jp64a.v.1.50.win.zip	md5/sha1
Linux:	jp32.v.1.50.lin.tar.gz*	jp64.v.1.50.lin.tar.gz	jp64a.v.1.50.lin.tar.gz	md5/sha1
macOS:	Not Available	jp.v.1.50.dmg	jp.v.1.50.dmg	md5/sha1

NTFS Directory Enumerator (ntfsdir)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	ntfsdir32.v.1.46.win.zip	ntfsdir64.v.1.46.win.zip	ntfsdir64a.v.1.46.win.zip	md5/sha1
Linux:	ntfsdir32.v.1.46.lin.tar.gz*	ntfsdir64.v.1.46.lin.tar.gz	ntfsdir64a.v.1.46.lin.tar.gz	md5/sha1
macOS:	Not Available	ntfsdir.v.1.46.dmg	ntfsdir.v.1.46.dmg	md5/sha1

NTFS File Copy Utility (ntfscopy)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	ntfscopy32.v.1.14.win.zip	ntfscopy64.v.1.14.win.zip	ntfscopy64a.v.1.14.win.zip	md5/sha1
Linux:	ntfscopy32.v.1.14.lin.tar.gz*	ntfscopy64.v.1.14.lin.tar.gz	ntfscopy64a.v.1.14.lin.tar.gz	md5/sha1
macOS:	Not Available	ntfscopy.v.1.14.dmg	ntfscopy.v.1.14.dmg	md5/sha1

Windows $MFT and NTFS Metadata Extractor Tool (ntfswalk)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	ntfswalk32.v.0.95.win.zip	ntfswalk64.v.0.95.win.zip	ntfswalk64a.v.0.95.win.zip	md5/sha1
Linux:	ntfswalk32.v.0.95.lin.tar.gz*	ntfswalk64.v.0.95.lin.tar.gz	ntfswalk64a.v.0.95.lin.tar.gz	md5/sha1
macOS:	Not Available	ntfswalk.v.0.95.dmg	ntfswalk.v.0.95.dmg	md5/sha1

Windows INDX Slack Parser (wisp)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	wisp32.v.0.59.win.zip	wisp64.v.0.59.win.zip	wisp64a.v.0.59.win.zip	md5/sha1
Linux:	wisp32.v.0.59.lin.tar.gz*	wisp64.v.0.59.lin.tar.gz	wisp64a.v.0.59.lin.tar.gz	md5/sha1
macOS:	Not Available	wisp.v.0.59.dmg	wisp.v.0.59.dmg	md5/sha1

Graphical Engine for NTFS Analysis (gena)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	gena32.v.0.60.win.zip	gena64.v.0.60.win.zip	gena64a.v.0.60.win.zip	md5/sha1
Linux:	gena32.v.0.60.lin.tar.gz*	gena64.v.0.60.lin.tar.gz	gena64a.v.0.60.lin.tar.gz	md5/sha1
macOS:	Not Available	gena.v.0.60.dmg	gena.v.0.60.dmg	md5/sha1

$MFT and $LogFile Analysis (mala)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	mala32.v.0.24.win.zip	mala64.v.0.24.win.zip	mala64a.v.0.24.win.zip	md5/sha1
Linux:	mala32.v.0.24.lin.tar.gz*	mala64.v.0.24.lin.tar.gz	mala64a.v.0.24.lin.tar.gz	md5/sha1
macOS:	Not Available	mala.v.0.24.dmg	mala.v.0.24.dmg	md5/sha1

Network Support Utilities (top)

DNS Query Utility (dqu)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	dqu32.v.0.49.win.zip	dqu64.v.0.49.win.zip	dqu64a.v.0.49.win.zip	md5/sha1
Linux:	dqu32.v.0.49.lin.tar.gz*	dqu64.v.0.49.lin.tar.gz	dqu64a.v.0.49.lin.tar.gz	md5/sha1
macOS:	Not Available	dqu.v.0.49.dmg	dqu.v.0.49.dmg	md5/sha1

Packet Capture ICMP Carver (pic)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	pic32.v.0.40.win.zip	pic64.v.0.40.win.zip	pic64a.v.0.40.win.zip	md5/sha1
Linux:	pic32.v.0.40.lin.tar.gz*	pic64.v.0.40.lin.tar.gz	pic64a.v.0.40.lin.tar.gz	md5/sha1
macOS:	Not Available	Not Available	Not Available

Network Xfer Client/Server Utility (nx)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	nx32.v.0.43.win.zip	nx64.v.0.43.win.zip	nx64a.v.0.43.win.zip	md5/sha1
Linux:	nx32.v.0.43.lin.tar.gz*	nx64.v.0.43.lin.tar.gz	nx64a.v.0.43.lin.tar.gz	md5/sha1
macOS:	Not Available	nx.v.0.43.dmg	nx.v.0.43.dmg	md5/sha1

Modular Inspection Network Xfer Agent (minx)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	minx32.v.0.29.win.zip	minx64.v.0.29.win.zip	minx64a.v.0.29.win.zip	md5/sha1
Linux:	minx32.v.0.29.lin.tar.gz*	minx64.v.0.29.lin.tar.gz	minx64a.v.0.29.lin.tar.gz	md5/sha1
macOS:	Not Available	minx.v.0.29.dmg	minx.v.0.29.dmg	md5/sha1

Portable Executable Utilities (top)

Windows Portable Executable Viewer (pe_view)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	pe_view32.v.1.27.win.zip	pe_view64.v.1.27.win.zip	pe_view64a.v.1.27.win.zip	md5/sha1
Linux:	pe_view32.v.1.27.lin.tar.gz*	pe_view64.v.1.27.lin.tar.gz	pe_view64a.v.1.27.lin.tar.gz	md5/sha1
macOS:	Not Available	pe_view.v.1.27.dmg	pe_view.v.1.27.dmg	md5/sha1

Portable Executable Scanner (pescan)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	pescan32.v.0.66.win.zip	pescan64.v.0.66.win.zip	pescan64a.v.0.66.win.zip	md5/sha1
Linux:	pescan32.v.0.66.lin.tar.gz*	pescan64.v.0.66.lin.tar.gz	pescan64a.v.0.66.lin.tar.gz	md5/sha1
macOS:	Not Available	pescan.v.0.66.dmg	pescan.v.0.66.dmg	md5/sha1

Miscellaneous Tools (top)

Volume Shadow Snapshot Enumerator (vssenum)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	vssenum32.v.0.39.win.zip	vssenum64.v.0.39.win.zip	vssenum64a.v.0.39.win.zip	md5/sha1
Linux:	Not Available	Not Available	Not Available
macOS:	Not Available	Not Available	Not Available

Windows Symbol Fetch Utility (sf)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	sf32.v.0.65.win.zip	sf64.v.0.65.win.zip	sf64a.v.0.65.win.zip	md5/sha1
Linux:	Not Available	Not Available	Not Available
macOS:	Not Available	Not Available	Not Available

CSV Data eXchange (csvdx)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	csvdx32.v.0.43.win.zip	csvdx64.v.0.43.win.zip	csvdx64a.v.0.43.win.zip	md5/sha1
Linux:	csvdx32.v.0.43.lin.tar.gz*	csvdx64.v.0.43.lin.tar.gz	csvdx64a.v.0.43.lin.tar.gz	md5/sha1
macOS:	Not Available	csvdx.v.0.43.dmg	csvdx.v.0.43.dmg	md5/sha1

Disk Utility & Packer (dup)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	dup32.v.0.49.win.zip	dup64.v.0.49.win.zip	dup64a.v.0.49.win.zip	md5/sha1
Linux:	Not Available	dup64.v.0.49.lin.tar.gz	dup64a.v.0.49.lin.tar.gz	md5/sha1
macOS:	Not Available	dup.v.0.49.dmg	dup.v.0.49.dmg	md5/sha1

Package Builds (top)

April 2025 build (package)

	Intel 32-bit Version	Intel 64-bit Version	ARM 64-bit Version
Windows:	2025.04.26.win32.zip	2025.04.26.win64.zip	2025.04.26.win64a.zip	md5/sha1
Linux:	Not Available	2025.04.26.lin64.zip	2025.04.26.lin64a.zip	md5/sha1
macOS:	Not Available	2025.04.26.mac.dmg	2025.04.26.mac.dmg	md5/sha1

*32bit apps can run in a 64bit linux distribution if "ia32-libs" (and dependencies) are present.