KAPE (Kroll Artifact Parser and Extractor)
Eric Zimmerman · Kroll · 2026
Access and status
Cost
Partly free
Part of it is free and part is not. The entry says which part; read that before you plan around it.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A Kroll-owned Windows triage tool that collects forensically relevant files from a live or mounted system using configurable Targets, then runs parsers over what it collected using Modules. It bypasses file locks with raw disk reads and preserves original timestamps on the copies.
Who it is for, and when
KAPE exists for the situation where full imaging is too slow to be useful: point it at a system, get the artefacts that answer most questions in minutes, and review those leads while the image is still being taken. Targets and Modules are plain configuration files maintained in the public KapeFiles repository, so the collection scope is auditable and can be tailored per matter. It is the usual front end for a whole-fleet or multi-host triage where the same artefact set is wanted from every machine.
What it does not cover
Note the licence carefully: the project documentation states KAPE is free for government, educational, research, and internal company use, and that as of 1 January 2026 it is no longer available for commercial use — meaning third-party networks or paid engagements. That rules it out for most consulting and expert-witness work, which is exactly where many practitioners previously used it. Technically, KAPE is also a triage collector, not an imager — it copies selected files and does not give you unallocated space, deleted file recovery, or a verifiable full-disk image.
Go to the source
Open at ericzimmerman.github.io (opens in a new tab)https://ericzimmerman.github.io/KapeDocs/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Eric Zimmerman
- Publisher
- Kroll
- Year
- 2026
- Topics
- triage, windows, incident-response, live-response, evidence-handling
- Checked at source
Related entries
A community-maintained, machine-readable knowledge base of digital forensic artefact definitions — where an artefact lives and how to collect it — expressed in YAML and licensed Apache-2.0. It is documented at artifacts.readthedocs.io and coordinated through the forensicartifacts Google Group and the Open Source DFIR Slack.
The incident response process as a discipline: preparation, detection and initial response, live collection from Windows and Unix, forensic duplication, network evidence, evidence handling, then analysis of hosts, traffic, attacker tools and routers, and report writing.
FTK Imager
Partly freeA free Windows imaging and preview tool, originally from AccessData and now distributed by Exterro, which acquired the FTK line. It creates raw, E01, and AD1 images, captures live RAM, previews file systems before acquisition, and produces hash verification reports.
MemProcFS
FreeAn open-source memory forensics tool that mounts a RAM image (or live memory) as a virtual file system, so processes, handles, registry, and network state appear as browsable files and directories rather than plugin output. It ships a Python and C API and a plugin ecosystem.
Velociraptor
FreeAn open-source endpoint visibility and DFIR platform built around VQL, a query language for collecting artefacts, monitoring events, and hunting across a fleet of agents. Development is sponsored by Rapid7, with the code still published under the Velocidex organisation.