KAPE
Definition
Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them with downstream tools.
- Full name
- Kroll Artifact Parser and Extractor
- Function
- Triage collection and parsing framework
- Source
- Live system or a disk image
- Origin
- Developed at Kroll by Eric Zimmerman
Common questions
How does KAPE differ from a full forensic image acquisition?+
KAPE selectively targets known artefact locations for rapid triage rather than copying an entire disk, letting examiners get actionable results in minutes instead of the hours a full image and processing pass would take.
What happens after KAPE collects the artefacts?+
It can automatically hand the collected files to configured parsing modules that produce readable output, rather than leaving the examiner with only raw files to interpret manually.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.