What is KAPE?

KAPE (Kroll Artifact Parser and Extractor) is a triage tool created by Eric Zimmerman. It is used to rapidly collect and parse forensic artifacts from a system. This enables investigators to quickly assess a system for potential indicators of compromise, malware, or other malicious activity, speeding up incident response and digital forensics investigations. It works by targeting specific files and data locations based on pre-defined target files and modules.