EZ Tools Forensic Analysis Report Template
Case Information
| Field |
Value |
| Case Number |
|
| Examiner |
|
| Date of Analysis |
|
| Evidence Source |
|
| Evidence Hash (SHA-256) |
|
| EZ Tools Version |
|
Artifacts Processed
| Artifact |
Tool Used |
Status |
Records Parsed |
| $MFT |
MFTECmd |
|
|
| $J (USN Journal) |
MFTECmd |
|
|
| Prefetch Files |
PECmd |
|
|
| LNK Files |
LECmd |
|
|
| Jump Lists |
JLECmd |
|
|
| Event Logs |
EvtxECmd |
|
|
| Registry Hives |
RECmd |
|
|
| Shellbags |
SBECmd |
|
|
| Recycle Bin |
RBCmd |
|
|
| Amcache |
AmcacheParser |
|
|
| ShimCache |
AppCompatCacheParser |
|
|
Key Findings
Program Execution Evidence
| Executable |
First Execution |
Last Execution |
Run Count |
Source |
|
|
|
|
|
Timestomping Indicators
| File |
$SI Created |
$FN Created |
Anomaly |
|
|
|
|
User Activity Timeline
| Timestamp |
Activity |
Artifact Source |
Details |
|
|
|
|
Lateral Movement Indicators
| Timestamp |
Source IP |
Target System |
Logon Type |
Event ID |
|
|
|
|
|
USB Device Connections
| Device |
Serial Number |
First Connected |
Last Connected |
Volume Name |
|
|
|
|
|
Conclusion
(Summary of findings based on artifact analysis)
Chain of Custody
| Date/Time |
Action |
Performed By |
Notes |
|
|
|
|
mukul975