Introducing KAPE - Kroll Artifact Parser and Extractor

Targets are essentially collections of file and directory specifications. KAPE knows how to read these specifications and expand them to files and directories that exist on a target location. Once KAPE has processed all targets and has built a list of files, the list is processed, and each file is copied from the source to the destination directory.

Files that are locked by the operating system and cannot be copied by regular means are, added to a secondary queue. This secondary queue contains all the files that were locked or in use. After the primary queue is processed the secondary queue is processed and a different technique, using raw disk reads, is used to bypass the locks. This results in getting a copy of the file as it exists at the source.

Regardless of how the file is copied (either by regular means or via raw access), the original timestamps from all directories and the files themselves are reapplied to the destination files. The metadata is also collected into log files as well. 

Like targets, modules are defined using simple YAML properties and are used to run programs. These programs can target anything, including files collected via the target capabilities as well as any other kinds of programs you may want to run on a system from a live response perspective. For example, if you collected jump lists, a tool like JLECmd could be used to dump the contents of the jump lists to CSV. If you also wanted to collect the output of netstat.exe or ipconfig /dnscache, you could do so as well. Each of these options would be contained in its own module and then grouped together based on commonality between the modules, such as “NetworkLiveResponse”, for example.