KAPE Resources

The Kroll Artifact Parser and Extractor (KAPE) has assisted investigators in solving insider threats faster than ever before due to its ability to process forensic artifacts within minutes.

Learn from two of our resident experts, Anthony Knutson and Aaron Read, as they discuss how best KAPE is used during insider threat investigations, its efficiencies for their teams and how it’s changing the landscape of forensic analysis.

Watch the full Insider Threat Investigations Using KAPE webcast.

In this session, KAPE creator Eric Zimmerman showcases how key Windows artifacts can be collected from a live or forensic image, parsed and reviewed in a few minutes using KAPE. Additionally, Eric demonstrates how to make custom targets to collect child exploitation material such as .jpgs, .pngs, .mp4s, etc. These examples can then be extended to meet the requirements of even the most complex cases.

Watch the full Child Exploitation Investigation with KAPE webcast.

In this webcast replay, KAPE instructor and Digital Forensics and Incident Response (DFIR) expert Mari DeGrazia showcases how key Windows artifacts can be collected from a live or forensic image, parsed and structured into a mini timeline in just a few minutes using KAPE.

Watch the full Express Artifact Analysis Timeline Development with KAPE webcast.

How much time are you spending manually parsing and sorting event logs? In this webcast, Kroll’s Andrew Rathbun demonstrates how to run EvtxECmd through KAPE to expedite event log analysis and how to create your custom maps.

Watch the full Enhancing Event Log Analysis with EvtxECmd using KAPE webcast