Eric Zimmerman

Eric serves as a Senior Director at Kroll in the company's cybersecurity and investigations practice and is a former Federal Bureau of Investigation (FBI) Special Agent. At SANS, he teaches the FOR508: Advanced Digital Forensics, Incident Response and Threat Hunting course, and is a two-time winner of the SANS DFIR NetWars Tournament (2014, 2015). Eric is also the award-winning author of X-Ways Forensics Practitioner's Guide, and has created many world-class, open-source forensic tools. He was also presented with the U.S. Attorney's Award for Excellence in Law Enforcement in 2013.

More About Eric

Profile

When Eric Zimmerman was a Special Agent with the FBI, one of his responsibilities was managing on-scene triage. He identified several gaps in an existing process and started creating solutions to address them. What began as building and expanding a few live response tools took Eric down a path that eventually led to him writing more than 50 programs that are now used by nearly 8,800 law enforcement officers in over 80 countries.

Much of Eric's work involved designing and building software related to investigations of sexual abuse of children. In a single year, Eric's programs led to the rescue of hundreds of these children. As a result, in May 2012, Eric was given a National Center for Missing and Exploited Children's Award, which honors outstanding law enforcement professionals who have performed above and beyond the call of duty. Eric was also presented with the U.S. Attorney's Award for Excellence in Law Enforcement in 2013.

Eric is a sought-after instructor and speaker who brings expertise in the cyber realm, complex law enforcement investigations, computer forensics, expert witness testimony, computer systems design, and application architecture to his work and classroom.

"I enjoy teaching this material because of how much potential there is in it to move cases forward quickly," says Eric. "With the pace at which computer storage continues to grow, it will become more and more important for people to understand the most cost-effective artifacts and techniques so these can be leveraged to move through data more quickly."

Eric's teaching philosophy focuses on the long-term gains achieved by not only understanding the nuts and bolts of how to run a tool and consume output, but also getting a deeper understanding of how tools work "under the hood." Those "a-ha" moments are what has kept Eric coming back to the classroom since 2008. His focus on understanding the big picture of digital forensics prepares students to perform better analysis, do new research of their own, and identify the best tools or techniques to perform successful investigations - all skills that will have a lifelong impact.

And even though work brings him great rewards, Eric understands the value of work/life balance. In his spare time, he enjoys spending time with his family, hiking, going to amusement parks with his two sons, and even fitting in a bit of video gaming when possible.

Qualifications Summary:

  • Former Federal Bureau of Investigation (FBI) Special Agent
  • Creates and maintains many free world-class, open-source forensic tools
  • Award-winning author of X-Ways Forensics Practitioner's Guide
  • Faculty member at the SANS Technology Institute
  • Recipient of the National Center for Missing and Exploited Children's Award and the U.S. Attorney's Award for Excellence in Law Enforcement

Get to Know Eric Zimmerman:

ADDITIONAL CONTRIBUTIONS BY ERIC ZIMMERMAN:

WEBCASTS

From Seizure to Actionable Intelligence in 90 Minutes or Less, January 2020

Behind the Incident, July 2019

KAPE + EZ Tools and Beyond - OSDFCon 2019

A Guide to Eric Zimmerman's command line tools (EZ Tools), April 2019

Introduction to KAPE, March 2019

Exploring Registry Explorer, March 2018


POSTERS & CHEAT SHEETS

EZ Tools Command Line poster

EZ Tools Cheat Sheet

RECOGNITION

Eric was named as a 2020 Key Influencer in DFIR by Pro Digital


TOOLS

EZ Tools