# EZ Tools Forensic Analysis Report Template

## Case Information

| Field | Value |
|-------|-------|
| Case Number | |
| Examiner | |
| Date of Analysis | |
| Evidence Source | |
| Evidence Hash (SHA-256) | |
| EZ Tools Version | |

## Artifacts Processed

| Artifact | Tool Used | Status | Records Parsed |
|----------|-----------|--------|----------------|
| $MFT | MFTECmd | | |
| $J (USN Journal) | MFTECmd | | |
| Prefetch Files | PECmd | | |
| LNK Files | LECmd | | |
| Jump Lists | JLECmd | | |
| Event Logs | EvtxECmd | | |
| Registry Hives | RECmd | | |
| Shellbags | SBECmd | | |
| Recycle Bin | RBCmd | | |
| Amcache | AmcacheParser | | |
| ShimCache | AppCompatCacheParser | | |

## Key Findings

### Program Execution Evidence
| Executable | First Execution | Last Execution | Run Count | Source |
|-----------|----------------|---------------|-----------|--------|
| | | | | |

### Timestomping Indicators
| File | $SI Created | $FN Created | Anomaly |
|------|------------|------------|---------|
| | | | |

### User Activity Timeline
| Timestamp | Activity | Artifact Source | Details |
|-----------|----------|----------------|---------|
| | | | |

### Lateral Movement Indicators
| Timestamp | Source IP | Target System | Logon Type | Event ID |
|-----------|----------|--------------|------------|----------|
| | | | | |

### USB Device Connections
| Device | Serial Number | First Connected | Last Connected | Volume Name |
|--------|--------------|----------------|---------------|-------------|
| | | | | |

## Conclusion

_(Summary of findings based on artifact analysis)_

## Chain of Custody

| Date/Time | Action | Performed By | Notes |
|-----------|--------|-------------|-------|
| | | | |
