KAPE

KAPE (Kroll Artifact Parser and Extractor) is a free triage tool that rapidly collects and parses forensic artifacts from Windows systems, dramatically speeding up incident response and digital forensics.

Digital Forensics freeware incident-response triage windows-forensics

Overview

KAPE (Kroll Artifact Parser and Extractor) is a free Windows triage tool developed by Eric Zimmerman and maintained by Kroll. It performs two core functions: collecting forensic artifacts from a live or mounted system and parsing those artifacts into human-readable output. KAPE uses a target-and-module architecture where targets define what files to collect (e.g., MFT, registry hives, event logs, prefetch, browser history, jump lists, SRUM) and modules define which parsers or scripts run against them. It supports batch and interactive modes, remote collection, and integration with third-party tools such as Eric Zimmerman's suite, Hayabusa, and Volatility. KAPE is widely used by incident responders and forensic examiners to rapidly triage endpoints without full disk imaging.

Primary Use Cases

✔ Rapid triage collection of forensic artifacts (MFT, registry hives, event logs, prefetch, SRUM, browser history) from live Windows endpoints during incident response.

✔ Automated parsing of collected artifacts into human-readable reports using built-in modules and third-party tools like Eric Zimmerman's parsers and Hayabusa.

✔ Remote forensic collection from multiple endpoints using KAPE's remote mode and batch scripts for large-scale incident response.

Frequently Asked Questions

Yes. KAPE is distributed free of charge by Kroll for incident response and forensic triage. It is not open-source, but it is free for both personal and commercial use without licensing fees.

As of September 2026, the current stable release is KAPE 1.3.x, which includes expanded target and module libraries, improved remote collection, and support for newer Windows artifacts such as Windows 11 activity history and enhanced SRUM parsing.

KAPE performs targeted triage collection of high-value forensic artifacts rather than acquiring an entire disk image. This makes it much faster and more practical for incident response at scale, where collecting full images from hundreds of endpoints would be too slow. Investigators can follow up with full imaging only on systems that require deeper analysis.

KAPE can run against both live systems and mounted disk images. When analyzing images, you mount the image (using tools like Arsenal Image Mounter or FTK Imager) and point KAPE at the mounted volume to collect and parse artifacts just as you would on a live system.

KAPE is primarily a Windows triage tool, but it can be extended through custom targets and modules to collect from other file systems when mounted. For Linux and macOS forensics, dedicated tools are usually recommended, though KAPE modules can invoke cross-platform parsers where applicable.

Metadata

Official Website Visit Website

Category Info

Digital Forensics covers tools used to acquire, preserve, and analyze digital evidence from endpoints, memory, disks, and network traffic in support of incident response, investigations, and legal proceedings.

Added On

September 16, 2026

Last Updated

September 16, 2026