cyber-services-banner-desktop

Kroll Artifact Parser And Extractor (KAPE)

Find, collect and process forensically useful artifacts in minutes.

With KAPE, you can find and prioritize the most critical systems to your case and collect key artifacts before imaging.

This means no longer having to wait until full system images are gathered and then wading through data where typically less than 10% will have any forensic value.

 

"The gist of [KAPE] is that in as little as half an hour, we can go from disk imaging to substantive analysis of filesystem, shell, execution, event, and registry data."
Troy Larson, Microsoft

Download KAPE

We will use this information to respond to your inquiry and process your data in accordance with our privacy policy.

Purpose–Built to Expedite and Optimize Forensic Investigations

Predefined, continually updated targets and modules

Screening and Monitoring

Actionable intelligence in minutes
Actionable Intelligence in Minutes
Standardize forensic processes
Standardize Forensic Processes
DFIR Investigator of the Year
Developed by 3x Forensic 4:cast DFIR Investigator of the Year
How KAPE Works

Introducing KAPE

 

The Latest from KAPE

KAPE Events

Over 60 Predefined Targets and 90 Modules

KAPE has two primary phases – target collection and module execution:

  • Targets are essentially collections of file and directory specifications.
  • Modules are used to run programs, which can target anything, including files collected via targets as well as any other kinds of programs you may want to run on a system from a live response perspective.

KAPE gives you access to targets and modules for the most common operations required in forensic exams, helping investigators gather a wider range of artifacts in a fraction of the time, enriching evidentiary libraries.

 
Over 60 Predefined Targets and 90 Modules

Grouping Artifacts Expedites Triage

KAPE focuses on collecting and processing relevant data quickly, grouping artifacts in categorized directories such as EvidenceOfExecution, BrowserHistory and AccountUsage. Grouping things by category means an examiner no longer needs to know how to process prefetch, shimcache, amcache, userassist, etc., as they relate to evidence of execution artifacts.

Grouping Artifacts Expedites Triage

Standardize Forensic Processes

When handling an incident, forensic examiners are tasked with knowing which artifacts to collect, where they may reside, and how to collect the data without damaging the evidence or chain of custody. With KAPE, forensic examiners have a solution to find, collect and process forensic artifacts in a way that standardizes forensic engagements by leveraging a wider range of extracted artifacts. KAPE can also help facilitate the onboarding and training of new investigators by standardizing and scaling artifact pulls.

Standardize Forensic Processes
 
Continually Evolving Dynamic Solution 

Kroll works on some of the most complex and highest profile cyber incidents in the world and performs digital forensics and evidence collection for thousands of companies. This unique frontline insight from our experts is enhanced by input from the global DFIR community to actively contribute to the development of KAPE. To learn more:

 
 
Clarifying KAPE Usage Permission
  • KAPE is free for any local, state, federal or international government agency.
  • KAPE is free for educational and research use.
  • KAPE is free for internal company use.
  • KAPE requires a enterprise license when used on a third-party network and/or as part of a paid engagement.

Read more about KAPE enterprise licenses here.

Cyber Newsletter Subbscription

Increased Cyber Resilience with a Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.
Start Now

Stay Ahead with Kroll

KAPE Resources

This page houses official documentation relating the Kroll Artifact Parser and Extractor (KAPE). It will also contain the latest KAPE news, as well as webcasts, case studies, tutorials and other training materials. For any KAPE related questions or assistance with customizations, please contact [email protected].

Learn More

Explore Insights

News