I’m proud to announce KAPE (Kroll Artifact Parser and Extractor) is now available for download. KAPE is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, and parse them within a few minutes.
Having worked with and taught digital forensics for over 10 years in both law enforcement and enterprise environments, I understood how DFIR professionals could benefit from a program that collected and processed forensically valuable data quickly, potentially before any full system images were completed.
With key input from the digital forensics/incident response (DFIR) community, we also included predefined “targets” and “modules” for KAPE that help investigators gather a wider range of artifacts in a fraction of the time, enriching evidentiary libraries. KAPE is free for download here.
Note: If you're using KAPE commercially, we now have an enterprise license that will enable you to use KAPE on any engagements.
New KAPE Official Demo - Kroll recently published an official demo walkthrough of KAPE by Andrew Rathbun.
So… What Exactly is KAPE?
KAPE is a multi-function program that primarily:
- collects files and
- processes collected files with one or more programs.
KAPE reads configuration files on the fly and based on their contents, collects and processes relevant files. This makes KAPE very extensible in that the program’s author does not need to be involved to add or expand functionality.
As we will see later in more detail, KAPE uses the concepts of targets and modules to do its work. KAPE comes with a range of default targets and modules for operations most commonly required in forensic exams. These can also serve as models for creating new targets and modules.
How KAPE Works
At a high level, KAPE works by adding file masks to a queue. This queue is then used to find and copy files from a source location. For files that are locked by the operating system, a second run bypasses the lock. At the end of the process, KAPE will make a copy and preserve metadata about all available files from a source location into a given directory. The second (optional) stage of processing is to run one or more programs against the collected data. This too works by targeting either specific file names or directories. Various programs are run against the files, and the output from the programs is then saved in directories named after a category, such as EvidenceOfExecution, BrowserHistory or AccountUsage.
By grouping things by category, examiners of all skill levels have the means to discover relevant information regardless of an individual artifact's source. In other words, an examiner no longer need to know how to process prefetch, shimcache, amcache, userassist, etc., as they relate to evidence of execution artifacts. Ultimately, a wider range of artifacts can be leveraged for any given requirement.
So, In the end, we have a process that looks like this:
Before exploring how KAPE delivers these results, either as a single operation or in stages, let’s first discuss the concepts of targets and modules.
A Bit Deeper
As mentioned earlier, KAPE has two primary phases:
- target collection and
- module execution.
Targets and modules are both written using YAML, which is easy to read and to write. KAPE comes with many prebuilt targets and modules that can also serve as examples for building new ones in the future.
Why use KAPE? |
|---|
KAPE is a robust, free-software triage program that will target a device or storage location, find the most forensically important artifacts (based on your needs), and parse them within a few minutes. Because of its speed, KAPE allows investigators to find and prioritize the systems most critical for their case. Additionally, KAPE can be used to collect key artifacts prior to the start of the imaging process. While the imaging completes, the data generated by KAPE can be reviewed for leads, building timelines, etc. In short, KAPE gets you to the data (and its answers) much faster than more traditional means. Note: If you're using KAPE commercially, we now have an enterprise license that will enable you to use KAPE on any engagements. |
Stay Ahead with Kroll
Kroll Artifact Parser And Extractor (KAPE)
Kroll's Artifact Parser and Extractor (KAPE) – created by Kroll senior director and three-time Forensic 4:cast DFIR Investigator of the Year Eric Zimmerman – lets forensic teams collect and process forensically useful artifacts within minutes. Get more information on KAPE, access training materials or book a live session with a Kroll expert here.
KAPE Resources
This page houses official documentation relating the Kroll Artifact Parser and Extractor (KAPE). It will also contain the latest KAPE news, as well as webcasts, case studies, tutorials and other training materials. For any KAPE related questions or assistance with customizations, please contact [email protected].
Cyber and Data Resilience
Kroll merges elite security and data risk expertise with frontline intelligence from thousands of incident response, regulatory compliance, financial crime and due diligence engagements to make our clients more cyber resilient.
Computer Forensics
Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.
24x7 Incident Response
Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.
Digital Forensics and Incident Response
Kroll’s elite security leaders deliver rapid responses for over 3,000 incidents per year and have the resources and expertise to support the entire incident lifecycle, including litigation demands. Gain peace of mind in a crisis.
