KAPE — Triage & Artifact Collection

→

What it is

KAPE has two phases. Targets define which artifacts are copied (registry hives, event logs, prefetch, browser history, etc.) — even locked system files, via raw disk access. Modules then run parsing tools (many of Eric Zimmerman's EZ Tools) against the collected data and produce readable CSV/JSON.

License honesty: KAPE is free to use, but not open source — it is governed by Kroll's EULA and requires registration to download. Strictly speaking it doesn't belong in an "open source" catalog, but it's included because it's central to modern DFIR triage. The Targets/Modules definitions (.tkape/.mkape), by contrast, are community-maintained on GitHub under MIT.

→

Setup

Windows

Steps

# 1. Download from kroll.com/kape (requires registration)
# 2. Extract the ZIP — KAPE is portable, no installation
# 3. Run Get-KAPEUpdate.ps1 for the latest Targets/Modules
# 4. gkape.exe = GUI · kape.exe = command line

Run from a USB/external drive to minimize the footprint on the target system.

Update definitions

.\Get-KAPEUpdate.ps1

→

Targets — collection

Targets (.tkape) are YAML-like definitions of which files/paths to copy. Compound targets combine several into one.

Target	Collects
`!SANS_Triage`	Compound — broad triage set recommended as default
`!BasicCollection`	Core artifacts: registry, logs, prefetch, $MFT
`RegistryHives`	SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.dat
`EventLogs`	Windows .evtx event logs
`Prefetch`	.pf files (program execution evidence)
`FileSystem`	$MFT, $LogFile, $UsnJrnl, $J
`WebBrowsers`	Chrome/Edge/Firefox history, cache, cookies
`LNKFilesAndJumpLists`	Shortcut and jumplist artifacts

→

Modules — parsing

Modules (.mkape) run external tools against the collected artifacts. Many wrap Eric Zimmerman's EZ Tools.

Module / tool	Function
`!EZParser`	Compound — runs the entire EZ Tools suite against targets
`PECmd`	Parse Prefetch → program execution timeline
`MFTECmd`	Parse $MFT / $J → file timeline
`EvtxECmd`	Parse event logs → normalized CSV
`RECmd`	Registry parsing with batch plugins
`AmcacheParser`	Amcache.hve → installed/executed software
`LECmd / JLECmd`	LNK and JumpList parsing
`SBECmd`	ShellBags → folder browsing history

After parsing: Many open the CSV output in Timeline Explorer (also EZ Tools) or load it into Elastic/Splunk. Combine with Autopsy for deeper disk analysis of the same image.

→

CLI examples

Triage live C: with the SANS target

kape.exe --tsource C: --target !SANS_Triage \
  --tdest E:\out\%m --gui

Collect + parse in one go

kape.exe --tsource C: --target !SANS_Triage \
  --tdest E:\out \
  --module !EZParser --mdest E:\parsed

%m = machine name · %d = timestamp in destination path

Flag	Funktion
`--tsource`	Source (drive letter, image or folder)
`--target`	Target(s) to collect
`--tdest`	Destination for collected artifacts
`--module`	Module(s) to run for parsing
`--mdest`	Destination for parsed output
`--vhdx / --zip`	Package the collection as a VHDX container or ZIP
`--vss`	Include Volume Shadow Copies
`--debug / --trace`	Detailed logging

→

Triage-flow

Classic IR sequence: KAPE collects artifacts in minutes (Targets) → parses them to CSV (Modules/!EZParser) → the analyst triages in Timeline Explorer → suspicious machines get deep disk analysis in Autopsy or live response via Velociraptor. KAPE is the "quick overview", the others are the "deep dive".