KAPE targets

kape.exe --tsource C: --tdest <out> --target BasicCollection

Collect Windows forensic artifacts with KAPE, using predefined targets for standardized host triage.

Run it when you need standardized forensic collection: KAPE (Kroll Artifact Parser Extractor) copies system artifacts (targets: EVTX, registry, prefetch, LNK, amcache, MFT) to the output directory, with folder structure by category. The BasicCollection target gathers the essential triage set in one pass. In IR, KAPE is the reference Windows collector: fast and reproducible collection (targets define what is collected) and integration with parsers (KAPE runs parsers on collected data via modules). Evidence is preserved and analysis is done on copies.

Don't use it as complete collection: KAPE collects what targets define — case-specific artifacts (a specific file, app logs) are added with custom targets. Collection minimally alters the system (access times): IR order is respected (volatile first). And note: KAPE is a collector, not an analyzer — collected artifacts are processed with parsers (MFTECmd, EvtxECmd, PECmd) integrated in modules or separately. Review targets beforehand (defaults collect a lot; case-specific, just enough). For quick host triage, CyLR; KAPE shines with configurable targets and parser integration.