Kroll Artifact Parser and Extractor (KAPE) Resources
The latest KAPE tutorials, webinars and guides created by Kroll instructors.
Primarily a triage program, Kroll’s Artifact Parser and Extractor (KAPE) will target both device or storage locations to find the most forensically relevant artifacts (based on your needs) and parse them within a few minutes. Thus, arming investigators with the right tool to find and prioritize the more critical systems to their case.
"KAPE serves two primary functions: 1) collect files and 2) process collected files with one or more programs. By itself, KAPE does not do anything in relation to either of these functions, rather, they are achieved by reading configuration files on the fly, and based on the contents of these files, collecting and processing files. This makes KAPE very extensible in adding or extending functionality." – Eric Zimmerman .
This page will hold official documentation as well as the latest KAPE news, webinars, tutorials, and more. See list below: