Quick answer: KAPE (Kroll Artifact Parser and Extractor) is a free triage tool that collects and parses only the forensically valuable artifacts from a Windows system within minutes. Its logic has two parts: Targets collect files (prefetch, event logs, registry, browser data, LNK), and Modules parse the collected files into readable output. KAPE does not take a full image, that is the point, it extracts key artifacts without waiting on a terabyte disk. It is ideal for a "fast answer" in the first hours of incident response. But triage is not full examination, KAPE lets you assess an incident quickly, it does not replace deep analysis.

In a ransomware incident the clock runs. Taking a full image of every device across a 200 machine network takes days, and the attacker keeps advancing meanwhile. What you need is not every disk in full but a fast answer to "is this machine compromised, when and how". KAPE was designed for exactly this. This article explains the triage concept and KAPE through a training lens.

What triage is and how it differs from full imaging

In medicine, triage is quickly deciding who gets treated first in the emergency room. Forensics is similar: with many devices in hand, quickly separating which one actually matters.

  • A full image is a bit for bit copy of the disk. It is the most complete evidence but takes long to acquire and examine.
  • Triage collects only valuable artifacts. It takes minutes, gives most of the story but not all.

The rule: triage does not replace full imaging, it precedes it. You look quickly with KAPE, then image the machine that turns out to matter. See our article on imaging with FTK Imager.

How KAPE works: Targets and Modules

All of KAPE's power sits in two concepts.

Target. Defines which files to collect. KAPE can copy even locked system files through raw disk access, meaning it gets registry hives and event logs that are normally inaccessible while Windows runs. Ready made target collections exist: a target like !SANS_Triage collects all the most critical artifacts in one command.

Module. Parses the collected files. If a target collected prefetch files, the relevant module turns them into a readable list of executed programs. Modules usually call Eric Zimmerman's tools (PECmd, LECmd, RECmd, EvtxECmd).

The two stages are separate: you collect first (Target), then parse (Module). You can collect on the suspect machine and parse on your own analysis machine.

Which artifacts KAPE collects

A short list of the key traces a triage extracts:

Artifact What it shows
Prefetch Which program ran, when and how many times
Registry hives Persistence, USB history, user settings
Windows event logs Logons, service installs, PowerShell activity
LNK and jump lists Which files were opened, which paths used
Browser data Addresses visited, downloads
SRUM Network use and resource consumption per application
Amcache and ShimCache Evidence of executed binaries
Memory dump and page file Volatile data, to a limited extent

Collecting this list one by one by hand takes hours. KAPE does it in minutes with one command.

Relationship with the Eric Zimmerman tools

While learning KAPE you meet one name constantly: Eric Zimmerman. These standalone tools (all free) parse a specific artifact expertly:

  • PECmd, prefetch
  • LECmd, LNK files
  • RECmd and Registry Explorer, registry
  • EvtxECmd, event logs
  • MFTECmd, file system MFT
  • JLECmd, jump lists

KAPE modules often call these tools. A good examiner uses KAPE for speed and these tools for deep, pinpoint analysis. You must learn both.

The flow of a triage examination

  1. Collect. Run KAPE from a USB stick on the suspect machine, choose a triage target and write output to a clean external disk. Do not write to the suspect machine's own disk.
  2. Move. Take the collected artifacts to your analysis machine. Do not run analysis on the suspect machine.
  3. Parse. Run the relevant modules. Output is usually CSV.
  4. Tie to a timeline. Combine parsed artifacts into a single timeline. For a deep super timeline, see our article on timeline with Plaso.
  5. Decide. Answer "does this machine matter, should I take a full image". That is the purpose of triage.

Legal and evidence integrity note

KAPE does not skip evidence rules for the sake of speed. Integrity must be preserved during collection too:

  • Hash the collected artifacts. Triage output is evidence too.
  • Keep KAPE's log recording that it ran and what it collected, as part of the chain of custody.
  • Writing output to the suspect machine's own disk contaminates evidence, always write to clean external media.
  • Running it on an unauthorized system is unlawful. See our article on the forensic process and chain of custody.

Learning path

Stage 1. Learn what each Windows artifact tells you. KAPE collects but does not interpret, interpretation is your job.

Stage 2. Run KAPE on your own test machine, collect with a triage target, then parse with a module. Recognize your own activity in the output.

Stage 3. Learn the Eric Zimmerman tools one by one. KAPE automates them, but running them individually teaches how the work is done.

Stage 4. Practice turning triage output into a timeline. Balance speed and depth.

Common mistakes

  • Treating triage as full examination. KAPE gives a fast answer, not a substitute for deep analysis.
  • Writing output to the suspect machine. It contaminates evidence. Use clean external media.
  • Not hashing. Triage output is evidence too.
  • Collecting without interpretation. Collecting artifacts is easy, making sense of them is the real skill.
  • Not eliminating known good activity. Noise hides the important event.
  • Running on an unauthorized system. It creates legal problems.

Frequently asked questions

Is KAPE free? Yes, it is offered free for personal and corporate use.

Does KAPE acquire images? No, it is a triage tool. Full imaging requires separate tools.

Can KAPE be used on a live running system? Yes, it can collect even locked files on a running system through raw disk access. That is its main use case.

Does KAPE collect Linux artifacts? It is primarily Windows focused. Linux and macOS have different triage approaches.

GUI or command line? Both exist. gkape is the graphical interface, kape the command line. For automation, the command line is preferred.

Is triage sufficient on its own? Machines that appear important need a full image and deep analysis. Triage is a starting point.

Sources

The first hours of an incident decide the outcome, and fast triage buys back lost time. For support or DFIR triage training for your team, contact DSET. We provide 24/7 incident response from our Ankara Hacettepe Teknokent laboratory.