KAPE

kroll.comsite

Kroll Artifact Parser and Extractor (KAPE) by Eric Zimmerman. A triage tool that finds the most prevalent digital artifacts and then parses them quickly. Great and thorough when time is of the essence.

from

Incident Response

added

2026-10-10

likes

0

similar

1. ▲
   Kroll Artifact Parser and Extractor (KAPE) learn.duffandphelps.com

   site category #ctf link ↗

   Triage program.

2. ▲
   KAPE kroll.com

   site category #malware-persistence link ↗

   The tool allows collecting various predefined artifactgs using targets and modules, see KapeFiles which include persistence mechanisms, among others there's a collection of LNK files, scheduled task files and scheduled task listing or a WMI repository auditing module.

   
3. ▲
   macOS Artifact Parsing Tool (mac_apt) github.com

   tool category #incident-response link ↗

   Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.

   
4. ▲
   CAPEC - Common Attack Pattern Enumeration and Classification capec.mitre.org

   site category #malware-analysis link ↗
5. ▲
   Digital Forensics Artifact Knowledge Base github.com

   tool category #incident-response link ↗

   Digital Forensics Artifact Knowledge Base

   
6. ▲
   Kaitai Struct github.com

   tool category #hacking link ↗

   a DSL for creating parsers in a variety of programming languages. The Web IDE is particularly useful for reverse-engineering.

   

Incident Response › IR Tools Collection > Windows Evidence Collection: “Kroll Artifact Parser and Extractor (KAPE) by Eric Zimmerman. A triage tool that finds the most prevalent digital artifacts and then parses them quickly. Great and thorough when time is of the essence.”