LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Kroll
KAPE (Kroll Artifact Parser and Extractor)
KAPE copies the files an examiner needs from a Windows system or image in minutes and then runs other programs over them. It is the quickest route from a live machine to parsed artefacts.
SoftwareFreeCurrentWindows
Profile
- Manufacturer
- Kroll
- Category
- Network and enterprise
- Product type
- Software
- Platforms
- Windows
- Licensing
- Free
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Created by Eric Zimmerman and published by Kroll. Kroll's product page refused automated checking on 2 Nov 2026, so the licence wording follows the KAPE documentation at ericzimmerman.github.io/KapeDocs, which states free use for government, education, research and internal company purposes and no commercial use from 1 January 2026. Windows is listed because the documentation requires Microsoft .NET Framework 4.5.2 and administrator rights.
What KAPE (Kroll Artifact Parser and Extractor) is
KAPE was written by Eric Zimmerman and is published by Kroll. There is nothing to install. The zip is unpacked, the program needs Microsoft .NET Framework 4.5.2 or newer and must run with administrator rights. It works in two phases. A target is a small text configuration that lists file and directory specifications, such as the master file table, event logs, registry hives or prefetch files. KAPE expands the target against the source, copies the matching files to the destination with their original timestamps reapplied, logs the metadata and reads files the operating system has locked through raw disk access. A module then runs a program over the collected files or the live system and files the output under category folders such as EvidenceOfExecution, BrowserHistory and AccountUsage, so an examiner looks for a category rather than for a parser. Output can go to a folder, a zip or a VHDX container, and a UNC path or SFTP server can be the destination. gkape is the graphical front end that builds the command line, and batch mode runs several collections from one file.
The source can be a live drive, a mounted image or a drive letter from a mounted virtual disk, which is why KAPE is used both by first responders and by laboratory examiners who want parsed artefacts before a full image is processed. Licensing changed recently. The KAPE documentation says it is free for any government agency and for educational, research and internal company use, and that as of 1 January 2026 it is no longer available for commercial use, meaning use on a third-party network or as part of a paid engagement. A consultant must therefore check the current terms before using it on a client system. The collection is a logical copy, so the examiner hashes the output and keeps the KAPE log with the case.
Primary applications
Where it is used
- Triage collection from a live Windows machine before or instead of full imaging
- Collecting artefacts from a mounted image for quick parsing
- Running Eric Zimmerman's parsers in bulk through modules
- Packaging artefacts in a VHDX or zip to hand to another examiner
- Sending collections from a remote site to an SFTP server
- Preparing a folder of artefacts for Plaso or Timesketch
Who uses it
- Incident responders
- Law enforcement first responders
- Corporate security and internal investigation teams
- Students of Windows forensics
Capabilities and limits
Major capabilities
- Targets that describe which files to collect and modules that describe what to run on them
- Copies locked system files through raw disk reads
- Reapplies original timestamps and logs metadata for every collected file
- Output to folders, zip or VHDX containers, locally or to a UNC path
- SFTP mode for transfer to a server and batch mode for scripted runs
- gkape graphical front end
- Category folders that group parsed output by what it proves
- Community-maintained target and module definitions
Technical limitations
- Windows only, both as the system it runs on and the artefacts it understands
- Logical collection. Deleted files and unallocated space are not touched
- Running on a live host changes that host and needs administrator rights
- Target definitions must be current for the Windows version examined
- Parsed output is only as good as the program the module calls
- No longer available for commercial use since 1 January 2026, by the documentation's own statement
Learning with DFRTI
Independent professional education covering the principles and workflows of KAPE (Kroll Artifact Parser and Extractor). DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- Windows artefacts and what each one proves
- Command line use
- Handling and hashing of logical collections
Disciplines
Related tools
- Eric Zimmerman's ToolsA set of free, signed Windows forensic utilities, one per artefact, that turn registry hives, the master file table, event logs, prefetch, shellbags and jump lists into CSV an examiner can read in Timeline Explorer.Eric Zimmerman
- VelociraptorVelociraptor puts a small agent on endpoints and lets an examiner ask them questions in a query language. A hunt sends the same question to every machine and the answers come back as tables.Rapid7
- PlasoPlaso pulls every timestamp it can recognise out of a disk image or folder and writes them to one storage file. Sorted, that file is the super timeline investigators use to see what happened in what order.log2timeline project
- TimesketchTimesketch is a web application where several analysts work on the same timeline. Events from Plaso or CSV go into a sketch and the team searches, tags, comments and builds its account of events from them.Google (open source project)
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
Courses that cover this tool
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.