KAPE

What KAPE does

Targeted artefact collection and processing

KAPE (Kroll Artifact Parser and Extractor) rapidly collects targeted forensic artefacts from a live Windows system or mounted evidence source. Analysts use Targets to define what should be copied and Modules to run approved parsers against the collected material.

Triage fit

KAPE is particularly useful during triage when time is limited and a complete disk acquisition is unnecessary or not yet available. It reduces collection volume, but it does not remove the need to document authority, source, destination, time, tool version and collection limitations.

Choose the operating pattern

• Collect only
  Use Targets to copy selected artefacts while preserving their recreated directory structure. This is the best beginner route.
• Collect and parse
  Use Targets and approved Modules when rapid derived output is needed and both the source artefacts and parser context can be retained.
• Mounted evidence
  Point KAPE at a mounted image or evidence source when live-system change is unsuitable; document the mount and access mode.

Definition context

Targets and Modules are definitions as well as interface choices. Record the exact .tkape and .mkape files used because community definitions can change independently of the KAPE executable.

Derived evidence

A parser result is derived evidence: keep the collected source artefact and the Module configuration needed to reproduce it.

Choose your journey

You do not need to complete every section. Choose the route that matches your current task:

01Install and open gkape

Obtain KAPE, extract it to the SUSA workstation and open the graphical interface.

Complete when gkape opens and displays its current Targets and Modules.Beginner · Windows workstation · 10–20 min 02Collect a triage set

Configure an authorised source, separate destination and the !SANS_Triage target.

Complete when the expected artefact folders exist at the destination.Guided beginner · Authorised Windows source · 20–45 min 03Review the evidence

Confirm provenance, inspect the collected folders and record errors or omissions.

Complete when another analyst can identify what KAPE collected and from where.Beginner · Collected triage set · 15–30 min 04Go hands-on

Practise gkape in the browser, then complete a realistic self-hosted triage exercise.

Complete when your evidence checklist and bounded finding are reviewable.Two alternative routes · Beginner to intermediate

Evidence workflow

1 Authorised source›2 Target selection›3 Collection›4 Output folders›5 Review and report

When troubleshooting, follow the path from left to right. Confirm that the source and destination are correct before checking target selection, execution messages, output folders and downstream parsing.

Before you begin

Collection boundary

Use only a system or image you own or are explicitly authorised to examine. Write output to a separate destination with sufficient free space. Record the KAPE version, source identifier, destination, selected Targets or Modules, collection time and any warnings.

Collection changes a live system

Running KAPE on a live endpoint reads many files and creates process, filesystem and destination activity. Record these expected changes and use an isolated training VM for the exercises in this section.

Targets and Modules

Component	Purpose	Beginner guidance
Target	Defines artefacts to copy from the source	Start with one documented compound Target such as !SANS_Triage
Module	Runs a parser or processor	Leave Modules disabled until the collection-only workflow succeeds
Source	Live volume or mounted evidence	Confirm the identifier and authority before execution
Destination	Location for copied output	Use a separate working volume and preserve free-space details

Evidence quality and limitations

• Selection has boundaries: An artefact outside the chosen Target is not collected.
• Absence needs context: A missing file may reflect scope, permissions, locking, source paths or collection errors; it does not show that the artefact never existed.
• Live triage leaves a footprint: Access times, caches, logs and destination storage can change. Record the expected activity and use a mounted image where the case requires it.
• Parser output is derived evidence: Modules may invoke external binaries. Preserve versions, command lines, errors and the source material used by each parser.
• Definitions can change: Sync with GitHub updates community Targets and Modules. Review and record changes before a repeatable workflow.

Analyst decisionYou need a rapid Windows triage set, but you have not reviewed any parser configurations. What is the proportionate first route?

Run one reviewed compound Target to a separate destination, preserve its definition and assess the collected source artefacts before enabling ModulesSelect every Target and Module so nothing can be missedUse the source volume as the destination to save time

Select the route that keeps collection bounded and reviewable.