KAPE (Kroll Artifact Parser and Extractor).

A Windows triage tool from Kroll that collects forensic artifacts from live systems or images and then runs parser modules to produce ready-to-review output. It belongs to the Forensics & IR category of cybersecurity.

A Windows triage tool from Kroll that collects forensic artifacts from live systems or images and then runs parser modules to produce ready-to-review output.

KAPE, written by Eric Zimmerman at Kroll, is a free triage framework for Windows DFIR. It uses two pluggable libraries: Targets describe which forensic artifacts to copy (Prefetch, registry hives, event logs, $MFT, browser history, etc.) and Modules describe how to parse them with third-party tools such as the EZ Tools or Volatility. Investigators run KAPE against a live endpoint, mounted image or volume shadow copy to collect data in minutes rather than hours, preserving timestamps and source paths. Output can be CSV, JSON or formats consumable by Timeline Explorer and Elastic. KAPE has become a standard part of intrusion response playbooks.

Defences for KAPE (Kroll Artifact Parser and Extractor) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Kroll Artifact Parser and Extractor.