thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Kroll Artifact Parser and Extractor (KAPE)

A free triage tool that collects and parses forensic artifacts from Windows systems using targets and modules.

Definition

KAPE targets define files to collect, such as event logs, registry hives, $MFT and browser databases, and modules run parsers like Eric Zimmerman's tools against them. It is widely used by incident responders for fast collection.

Example

kape.exe --tsource C: --target KapeTriage --tdest D:\out

Exam tip

KAPE targets collect; modules process.

Related terms